Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    NEAS.045848ae3096362920d4a701b216bd30_JC.exe

  • Size

    720KB

  • Sample

    231105-t3699sgh4x

  • MD5

    045848ae3096362920d4a701b216bd30

  • SHA1

    955b04eba6c60c3573e3c557c9725cfdb5c23dce

  • SHA256

    4661ac1cd1649de19baa27c5434965705b97b3f6d57e4c72b6db703749fa6c40

  • SHA512

    809a73dd36cdf436ec0bf02a388b63d86e890f5665ad0f9f37a6e82aa90b052732685a38ee07f681361e9a7d8942b9e3be029cf9edb8ba4a446290171cf2e894

  • SSDEEP

    12288:DquErHF6xC9D6DmR1J98w4oknqOKw/zTd1RVaHvymUi6rjXrm62iU952aLovi754:arl6kD68JmloO7TdNaPymUi63i62xHLE

Malware Config

Extracted

Family

azorult

C2

http://185.79.156.23/j0n0/index.php

Targets

    • Target

      NEAS.045848ae3096362920d4a701b216bd30_JC.exe

    • Size

      720KB

    • MD5

      045848ae3096362920d4a701b216bd30

    • SHA1

      955b04eba6c60c3573e3c557c9725cfdb5c23dce

    • SHA256

      4661ac1cd1649de19baa27c5434965705b97b3f6d57e4c72b6db703749fa6c40

    • SHA512

      809a73dd36cdf436ec0bf02a388b63d86e890f5665ad0f9f37a6e82aa90b052732685a38ee07f681361e9a7d8942b9e3be029cf9edb8ba4a446290171cf2e894

    • SSDEEP

      12288:DquErHF6xC9D6DmR1J98w4oknqOKw/zTd1RVaHvymUi6rjXrm62iU952aLovi754:arl6kD68JmloO7TdNaPymUi63i62xHLE

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks