azorult

General

Target

Ziraat Bankasi Swift Mesaji.pdf.exe
Size

928KB
Sample

231204-t9kpvada74
MD5

ff8c44307760d3f89e78a8a95980d6ea
SHA1

dd2421cc6fd60a4caadf8ec88f6635276550543b
SHA256

c19611873222bfc236a1eeab96287424c06a987a877c164d21c7354fe72108c3
SHA512

ebcadc9b92942dcc8f28e8f689290218f752cf80ce8620ae7ada371f5f3963cf5e6d5f2f021c42a8946ba4235096399ba297ec21070d96ece7e3ffe6ed3a7259
SSDEEP

24576:npp43ue2YKmNBRx6ajNlHgKUKV3hIgnYj:ppNYKWPweNl15CgnA

Score

10^/10

Malware Config

Targets

- Target
  
  Ziraat Bankasi Swift Mesaji.pdf.exe
- Size
  
  928KB
- MD5
  
  ff8c44307760d3f89e78a8a95980d6ea
- SHA1
  
  dd2421cc6fd60a4caadf8ec88f6635276550543b
- SHA256
  
  c19611873222bfc236a1eeab96287424c06a987a877c164d21c7354fe72108c3
- SHA512
  
  ebcadc9b92942dcc8f28e8f689290218f752cf80ce8620ae7ada371f5f3963cf5e6d5f2f021c42a8946ba4235096399ba297ec21070d96ece7e3ffe6ed3a7259
- SSDEEP
  
  24576:npp43ue2YKmNBRx6ajNlHgKUKV3hIgnYj:ppNYKWPweNl15CgnA
Score

10^/10

azorult guloader downloader infostealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Loads dropped DLL

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2