azorult

General

Target
COA - SHIPPING DETAILS.exe
Size 947KB
Sample230619-q8849sec62
SHA256 79c480e4e624e767affddfda25ca5b454505dcf79f1c772f604e2a9e649fc69e
MD5 bb1ce76571f48fc3f8b46eb7190de98c
SHA1 f3d2d2b5d9e5d3cc4b3a9f14e868b5fd52701096
SHA512 d1608ebe6494c6de47f74f39bdc445197e2b3875793b53709389fb4292907466fdd020357c4fa90655d6a2c67ed5b204499971b90196a6be61798ba5f177b352
SSDEEP 24576:wT1kbCJN5gd5pI82SYxVSEIZBm4M725AavgV+wBXLYY9cUb:wTebqN5gdzXAVSE0Bc1UweOjb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

azorult

C2

http://dblxs.shop/Bll1/index.php

Targets

- Target
  COA - SHIPPING DETAILS.exe
- Size 947KB
- SHA256 79c480e4e624e767affddfda25ca5b454505dcf79f1c772f604e2a9e649fc69e
- MD5 bb1ce76571f48fc3f8b46eb7190de98c
- SHA1 f3d2d2b5d9e5d3cc4b3a9f14e868b5fd52701096
- SHA512 d1608ebe6494c6de47f74f39bdc445197e2b3875793b53709389fb4292907466fdd020357c4fa90655d6a2c67ed5b204499971b90196a6be61798ba5f177b352
- SSDEEP 24576:wT1kbCJN5gd5pI82SYxVSEIZBm4M725AavgV+wBXLYY9cUb:wTebqN5gdzXAVSE0Bc1UweOjb
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

azorult guloader collection discovery downloader infostealer spyware stealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Checks QEMU agent file
  Checks presence of QEMU agent, possibly to detect virtualization.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

5

T1081

Discovery

Query Registry

4

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Guloader,Cloudeye

Checks QEMU agent file

Checks computer location settings

Deletes itself

Loads dropped DLL

Reads data files stored by FTP clients

Reads local data of messenger clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2