azorult | 1688809445418496e2cd397e2[.]exe | Triage

Sharing

General

Target

1688809445418496e2cd397e2.exe
Size

112KB
MD5

1b0a8133cbc53ad132c5b70643509048
SHA1

8cfcf6aaca6f095771e80f03ed8dedf95bdef22e
SHA256

7897cbf57b2a25446cedc1995c9950478a2c371c99ef87a0c82c7544742925f8
SHA512

e63bc2b33543558511494f9362d22cd1ba9027c2d9f382176445884e12103b079c33ce34310c449d0290a5590c39ddbec2603b5c471e5cdeb80133d7a34224eb
SSDEEP

3072:tuOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEY3E/txg/:Zzx7ZApszolIo7lf/ipT/t

Score

10^/10

azorult

Malware Config

Extracted

Family

azorult

C2

http://46.183.221.76/rothschild/Panel/index.php

Signatures

Azorult family
azorult

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1688809445418496e2cd397e2.exe

Files

1688809445418496e2cd397e2.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ