azorult

Sharing

Copy URL

Twitter E-mail

General

Target

IMG_20240122.exe
Size

413KB
Sample

240122-l17t1sebh7
MD5

4ecfc2179cc495e4b7b3f75e7c6bd28b
SHA1

24ae8637aabb0d43db208a67cf9483774058debb
SHA256

e2ed0fc294f7ba96adc7f11fcfd6b1c92744e352a6c5ec1d845185d688e520ad
SHA512

f8fd96604655728137d1fd19583d661f42c8882482a86b41ec1a11167780765a56b1dac867fbee80f81a40b1af102b8f8a76fa32dde8bb015b949233f1f086dd
SSDEEP

6144:f4t6Lsvq5WSBHHvd7wNHH98uUkyiSp3hWD8+y8Vog6cjmSlJeL:fkvqcSBHHv6tH98uxZjAympcCoJw

Score

10^/10

Malware Config

Targets

- Target
  
  IMG_20240122.exe
- Size
  
  413KB
- MD5
  
  4ecfc2179cc495e4b7b3f75e7c6bd28b
- SHA1
  
  24ae8637aabb0d43db208a67cf9483774058debb
- SHA256
  
  e2ed0fc294f7ba96adc7f11fcfd6b1c92744e352a6c5ec1d845185d688e520ad
- SHA512
  
  f8fd96604655728137d1fd19583d661f42c8882482a86b41ec1a11167780765a56b1dac867fbee80f81a40b1af102b8f8a76fa32dde8bb015b949233f1f086dd
- SSDEEP
  
  6144:f4t6Lsvq5WSBHHvd7wNHH98uUkyiSp3hWD8+y8Vog6cjmSlJeL:fkvqcSBHHv6tH98uxZjAympcCoJw
Score

10^/10

azorult collection discovery infostealer spyware stealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  17ed1c86bd67e78ade4712be48a7d2bd
- SHA1
  
  1cc9fe86d6d6030b4dae45ecddce5907991c01a0
- SHA256
  
  bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
- SHA512
  
  0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
- SSDEEP
  
  192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  42b064366f780c1f298fa3cb3aeae260
- SHA1
  
  5b0349db73c43f35227b252b9aa6555f5ede9015
- SHA256
  
  c13104552b8b553159f50f6e2ca45114493397a6fa4bf2cbb960c4a2bbd349ab
- SHA512
  
  50d8f4f7a3ff45d5854741e7c4153fa13ee1093bafbe9c2adc60712ed2fb505c9688dd420d75aaea1b696da46b6beccc232e41388bc2a16b1f9eea1832df1cd7
- SSDEEP
  
  192:o68cSzvTyl4tgi8pPjQM0PuAg0YNyoIFtSP:LBSzm+t18pZ0WAg0RoIFg
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  b55f7f1b17c39018910c23108f929082
- SHA1
  
  1601f1cc0d0d6bcf35799b7cd15550cd01556172
- SHA256
  
  c4c6fe032f3cd8b31528d7b99661f85ee22cb78746aee98ec568431d4f5043f7
- SHA512
  
  d652f2b09396ef7b9181996c4700b25840ceaa6c1c10080a55ce3db4c25d8d85f00a21e747f9d14a3374be4cdd4ea829a18d7de9b27b13b5e304447f3e9268fa
- SSDEEP
  
  96:L7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN538:RbGgGPzxeX6D8ZyGgmkN
Score

3^/10
behavioral7 behavioral8
- Target
  
  Udsprjtedes/Fejelistes/megapode.app
- Size
  
  15KB
- MD5
  
  6e941ea97a92ac8ee4ac713c354c58f6
- SHA1
  
  3f23f03bf6547b2bf4b8a6eb00777a55aaf999ce
- SHA256
  
  a3a45b243179f04a923e01a8f360aafa9d628b32354453f08c0b1c31797a534b
- SHA512
  
  d2b43f6cf6d7e74c1053416213fcc35c30ca029c0c2f34de9553ad2adb92b923daf83611ba9b7b9d905ad1e60c53434dcd7ea58d3c0bf47ffa8b0e59b6cea489
- SSDEEP
  
  384:U5FKcGSrXmxrPAn8EFGftXcMOxFILjA1BoLSw9QVN/Nr:IFUAYDEwftXcMkujKo6/Nr
Score

1^/10
behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Deletes itself

Loads dropped DLL

Reads data files stored by FTP clients

Reads local data of messenger clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9