General

  • Target

    c3b632097534ab83cb2b14213fb791bc.exe

  • Size

    721KB

  • Sample

    240111-vsctcadbf5

  • MD5

    c3b632097534ab83cb2b14213fb791bc

  • SHA1

    a2b659c40f71ad3f5de0f123719588dc444ee49f

  • SHA256

    739fd3d7e17c171e5c12d04d87ace07298dc966a4b072968ac87ca147721877b

  • SHA512

    3561731799dfbbd1e91ea0a5460aa1254c6d8700553020be0f08915e1b003e9c8dcd29b7c97c994be17d189b3a4e7571c8b87af4096bbb11585701e186e8d6b1

  • SSDEEP

    12288:DquErHF6xC9D6DmR1J98w4oknqOKw/zTd1RVaHvymUi6rjXrm62iU952aLovi75s:arl6kD68JmloO7TdNaPymUi63i62xHLg

Malware Config

Extracted

Family

azorult

C2

http://185.79.156.23/j0n0/index.php

Targets

    • Target

      c3b632097534ab83cb2b14213fb791bc.exe

    • Size

      721KB

    • MD5

      c3b632097534ab83cb2b14213fb791bc

    • SHA1

      a2b659c40f71ad3f5de0f123719588dc444ee49f

    • SHA256

      739fd3d7e17c171e5c12d04d87ace07298dc966a4b072968ac87ca147721877b

    • SHA512

      3561731799dfbbd1e91ea0a5460aa1254c6d8700553020be0f08915e1b003e9c8dcd29b7c97c994be17d189b3a4e7571c8b87af4096bbb11585701e186e8d6b1

    • SSDEEP

      12288:DquErHF6xC9D6DmR1J98w4oknqOKw/zTd1RVaHvymUi6rjXrm62iU952aLovi75s:arl6kD68JmloO7TdNaPymUi63i62xHLg

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Deletes itself

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks