Resubmissions

14/04/2023, 09:38

230414-ll52waag6w 10

14/04/2023, 07:09

230414-hy3whaac7w 10

General

  • Target

    Order__ AB PEGOL_PR-211299,PDF.iso.exe

  • Size

    428KB

  • Sample

    230414-ll52waag6w

  • MD5

    b889d75fa1012fbbcac08bfddcd53491

  • SHA1

    e57b2ebfd0cdaa1531bf94014261543f661363a2

  • SHA256

    2b530fe57ee4d4c4a4b642447703303131df9c4de53e9daf501cc5a8382781ec

  • SHA512

    7fdd731d5dd5faa0618d1c5a142831e275332f90e73edcd1ad514aa5c22950fbe181eb6f0e64099398d28fe29ed25f2a7a03db8c649a15a15cdffb044a18ccdb

  • SSDEEP

    6144:uTouKrWBEu3/Z2lpGDHU3ykJFqNbi/RXSNdHqNV8EAMoDxdrs5NMKQXXS:uToPWBv/cpGrU3ywumAKnjkncCe

Malware Config

Extracted

Family

azorult

C2

http://cinho.shop/PL341/index.php

Targets

    • Target

      Order__ AB PEGOL_PR-211299,PDF.iso.exe

    • Size

      428KB

    • MD5

      b889d75fa1012fbbcac08bfddcd53491

    • SHA1

      e57b2ebfd0cdaa1531bf94014261543f661363a2

    • SHA256

      2b530fe57ee4d4c4a4b642447703303131df9c4de53e9daf501cc5a8382781ec

    • SHA512

      7fdd731d5dd5faa0618d1c5a142831e275332f90e73edcd1ad514aa5c22950fbe181eb6f0e64099398d28fe29ed25f2a7a03db8c649a15a15cdffb044a18ccdb

    • SSDEEP

      6144:uTouKrWBEu3/Z2lpGDHU3ykJFqNbi/RXSNdHqNV8EAMoDxdrs5NMKQXXS:uToPWBv/cpGrU3ywumAKnjkncCe

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks