Overview

overview

10

Static

static

1

Price List...n).exe

windows7-x64

10

Price List...n).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Price List SOS (For Pilot Sewing Corporation).exe

  • Size

    2.4MB

  • Sample

    231219-cl966agbc3

  • MD5

    adea4bd26bc96903f34dee5172229a1c

  • SHA1

    09bd23a575c113b3aafe91616e1d84022a5645d4

  • SHA256

    40f6f4f30fbf01915a93db20f552b38681fcdcab5f0ad6491d9cb91e9d80139a

  • SHA512

    4f0edb516cd09a3dfecace9ae8e7fba230b150a1f93cfa933f425fdb1619593cabb242560e1dbcac61286232c3da541cc04bad69a4ea9f9483c72cc84551075d

  • SSDEEP

    49152:kriw4JVzn0Bcs9eZH2zPnkDg2ZI9FSdV7KczqM4b6FRATklR3I3FjPgfp:+Czn0BcwDYWSLmcWpbaRATk/41cfp

Score
10/10
azorultcollectioninfostealerspywarestealertrojan

Malware Config

Targets

    • Target

      Price List SOS (For Pilot Sewing Corporation).exe

    • Size

      2.4MB

    • MD5

      adea4bd26bc96903f34dee5172229a1c

    • SHA1

      09bd23a575c113b3aafe91616e1d84022a5645d4

    • SHA256

      40f6f4f30fbf01915a93db20f552b38681fcdcab5f0ad6491d9cb91e9d80139a

    • SHA512

      4f0edb516cd09a3dfecace9ae8e7fba230b150a1f93cfa933f425fdb1619593cabb242560e1dbcac61286232c3da541cc04bad69a4ea9f9483c72cc84551075d

    • SSDEEP

      49152:kriw4JVzn0Bcs9eZH2zPnkDg2ZI9FSdV7KczqM4b6FRATklR3I3FjPgfp:+Czn0BcwDYWSLmcWpbaRATk/41cfp

    Score
    10/10
    azorultcollectioninfostealerspywarestealertrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks