Resubmissions

06-12-2023 15:44

231206-s6hkmsea7x 10

16-11-2023 20:24

231116-y6snhage4w 10

05-04-2023 06:56

230405-hqtymacc52 10

04-04-2023 08:02

230404-jw4wfsdf69 10

General

  • Target

    ??????????? ??????????????.exe

  • Size

    234KB

  • Sample

    231206-s6hkmsea7x

  • MD5

    38d378ff52ea3dba53a07eee3ed769c7

  • SHA1

    94181ebcbe353d496701681b6bd03e06c1c63751

  • SHA256

    0791c43de42272d1f5eb20ee67b0ad4194e2bb8f00975aa906605d8cd0c4c6a4

  • SHA512

    ab096595c92f3bca5659b2156e3daed47f70dd8ab3ddff1506ff164a50fa4d15f2503776d43633056ebcb569255295f8f7af53a031f552da1a3f73d017c105cc

  • SSDEEP

    6144:gYa6oBsctoZqfq4S4JV2p9wubvEjRTsObhUXLbPp:gYxcCZqHp2prEVs+C7F

Malware Config

Extracted

Family

azorult

C2

http://141.98.6.162/office/index.php

Targets

    • Target

      ??????????? ??????????????.exe

    • Size

      234KB

    • MD5

      38d378ff52ea3dba53a07eee3ed769c7

    • SHA1

      94181ebcbe353d496701681b6bd03e06c1c63751

    • SHA256

      0791c43de42272d1f5eb20ee67b0ad4194e2bb8f00975aa906605d8cd0c4c6a4

    • SHA512

      ab096595c92f3bca5659b2156e3daed47f70dd8ab3ddff1506ff164a50fa4d15f2503776d43633056ebcb569255295f8f7af53a031f552da1a3f73d017c105cc

    • SSDEEP

      6144:gYa6oBsctoZqfq4S4JV2p9wubvEjRTsObhUXLbPp:gYxcCZqHp2prEVs+C7F

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks