General

  • Target

    FA010711pdf.exe

  • Size

    388KB

  • Sample

    231014-bf4azsha31

  • MD5

    2cff60ccfe9bf21d3f98f749a278ac62

  • SHA1

    e1e72717b047f2a9e08f208aa85f485c2115c89b

  • SHA256

    72465f74a5ef3b19cb51be862a02003bc406517bca79d5e4457223f95ee044b7

  • SHA512

    3db72f01e8e7a5a222c63c03bb14b9dd1baafbcde3dc24b03f7e4c631c4b14939df8172541d11e8e293be15cc314e87aaabc6c862790f7357f3a03930d79647f

  • SSDEEP

    6144:yYa6lMX3IjdMIQ5VcgYydjYku7NhM9bYqkazC:yYzPJMIQ5Vzm7zMtbzC

Malware Config

Extracted

Family

azorult

C2

http://46.183.220.70/bag/Panel/index.php

Targets

    • Target

      FA010711pdf.exe

    • Size

      388KB

    • MD5

      2cff60ccfe9bf21d3f98f749a278ac62

    • SHA1

      e1e72717b047f2a9e08f208aa85f485c2115c89b

    • SHA256

      72465f74a5ef3b19cb51be862a02003bc406517bca79d5e4457223f95ee044b7

    • SHA512

      3db72f01e8e7a5a222c63c03bb14b9dd1baafbcde3dc24b03f7e4c631c4b14939df8172541d11e8e293be15cc314e87aaabc6c862790f7357f3a03930d79647f

    • SSDEEP

      6144:yYa6lMX3IjdMIQ5VcgYydjYku7NhM9bYqkazC:yYzPJMIQ5Vzm7zMtbzC

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks