General
-
Target
2023 Haziran Ekstreniz.exe
-
Size
790KB
-
Sample
230614-fnjnrsdc9v
-
MD5
3d226b4fd4459eaa8072e280a3e5e115
-
SHA1
692f0ed445db630556342965d6ad65a0c39923f0
-
SHA256
f18ab6cd601b4c49bce537de83bb3a796dce1f7b93089cde9d11c004657edefc
-
SHA512
b5919ed8e8375aa3f42b3a97f63243b877ba3e9688831713a852d8b807d21b665c06f93c92930ef17a0364b1fba86bc31dda207e77b99a45d73a9a5cef794c38
-
SSDEEP
12288:GbM9g5j+R0SooQ++DsM0BiD7yfKlYpohXo+Mpm58M3sckknG2lQIto708vE:r9g5iyK+DsoeKlYpKnqm2O5n5QY88
Static task
static1
Behavioral task
behavioral1
Sample
2023 Haziran Ekstreniz.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023 Haziran Ekstreniz.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
azorult
http://dou3ble.shop/Dbl3/index.php
Targets
-
-
Target
2023 Haziran Ekstreniz.exe
-
Size
790KB
-
MD5
3d226b4fd4459eaa8072e280a3e5e115
-
SHA1
692f0ed445db630556342965d6ad65a0c39923f0
-
SHA256
f18ab6cd601b4c49bce537de83bb3a796dce1f7b93089cde9d11c004657edefc
-
SHA512
b5919ed8e8375aa3f42b3a97f63243b877ba3e9688831713a852d8b807d21b665c06f93c92930ef17a0364b1fba86bc31dda207e77b99a45d73a9a5cef794c38
-
SSDEEP
12288:GbM9g5j+R0SooQ++DsM0BiD7yfKlYpohXo+Mpm58M3sckknG2lQIto708vE:r9g5iyK+DsoeKlYpKnqm2O5n5QY88
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-