General

  • Target

    2023 Haziran Ekstreniz.exe

  • Size

    790KB

  • Sample

    230614-fnjnrsdc9v

  • MD5

    3d226b4fd4459eaa8072e280a3e5e115

  • SHA1

    692f0ed445db630556342965d6ad65a0c39923f0

  • SHA256

    f18ab6cd601b4c49bce537de83bb3a796dce1f7b93089cde9d11c004657edefc

  • SHA512

    b5919ed8e8375aa3f42b3a97f63243b877ba3e9688831713a852d8b807d21b665c06f93c92930ef17a0364b1fba86bc31dda207e77b99a45d73a9a5cef794c38

  • SSDEEP

    12288:GbM9g5j+R0SooQ++DsM0BiD7yfKlYpohXo+Mpm58M3sckknG2lQIto708vE:r9g5iyK+DsoeKlYpKnqm2O5n5QY88

Malware Config

Extracted

Family

azorult

C2

http://dou3ble.shop/Dbl3/index.php

Targets

    • Target

      2023 Haziran Ekstreniz.exe

    • Size

      790KB

    • MD5

      3d226b4fd4459eaa8072e280a3e5e115

    • SHA1

      692f0ed445db630556342965d6ad65a0c39923f0

    • SHA256

      f18ab6cd601b4c49bce537de83bb3a796dce1f7b93089cde9d11c004657edefc

    • SHA512

      b5919ed8e8375aa3f42b3a97f63243b877ba3e9688831713a852d8b807d21b665c06f93c92930ef17a0364b1fba86bc31dda207e77b99a45d73a9a5cef794c38

    • SSDEEP

      12288:GbM9g5j+R0SooQ++DsM0BiD7yfKlYpohXo+Mpm58M3sckknG2lQIto708vE:r9g5iyK+DsoeKlYpKnqm2O5n5QY88

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks