General

  • Target

    166e66e2ebf35b6cd7dec9cc32148b17

  • Size

    1.0MB

  • Sample

    231230-mxpppscgan

  • MD5

    166e66e2ebf35b6cd7dec9cc32148b17

  • SHA1

    44da381061aafeaea7729c3a900d62a21a083def

  • SHA256

    82181feef7f771b83a2507f4190b584cb0098185765a8031fabcc11c8a1662bf

  • SHA512

    4c9f34f6ceb91eebb10d0c0bc0fcb364e453fadde52d6bbef5cfd4f05014e3adddba62e9af6e132f7270386673d9f1f58ac0cbbaf062e16c6b7dc7b59eb48008

  • SSDEEP

    24576:I4lavt0LkLL9IMixoEFNYVAiEI7QYnbAhbK:fkwkn9IMSNYVf775bY

Malware Config

Extracted

Family

azorult

C2

http://37.0.11.174/PL341/index.php

Targets

    • Target

      166e66e2ebf35b6cd7dec9cc32148b17

    • Size

      1.0MB

    • MD5

      166e66e2ebf35b6cd7dec9cc32148b17

    • SHA1

      44da381061aafeaea7729c3a900d62a21a083def

    • SHA256

      82181feef7f771b83a2507f4190b584cb0098185765a8031fabcc11c8a1662bf

    • SHA512

      4c9f34f6ceb91eebb10d0c0bc0fcb364e453fadde52d6bbef5cfd4f05014e3adddba62e9af6e132f7270386673d9f1f58ac0cbbaf062e16c6b7dc7b59eb48008

    • SSDEEP

      24576:I4lavt0LkLL9IMixoEFNYVAiEI7QYnbAhbK:fkwkn9IMSNYVf775bY

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks