azorult

Sharing

Copy URL

Twitter E-mail

General

Target

noncontemptuously.exe
Size

404KB
Sample

240124-jld72sdca4
MD5

729c57440e69f1255a83e16d8f29f182
SHA1

653e1e252dac7dafcd7fb7d09b1f739ee906216b
SHA256

e8b6c66f884a6d398bfd6e86ee4af88673a9e6f50767e195288c3bdafbaaa205
SHA512

659dbe3b4aaa173a0a85614331327825056791475eb2235b936c7bd6c4211050077c1c9a0e3e2d11900a00956faf7f937d385db30af4f61f39769a0fceee3ee0
SSDEEP

6144:h4t6Lsvq5WSBHoKC/Y3Y/kclNOmLNWnC8MwMLpXog6cjmSlJe:hkvqcSBHoKCAY/kclNOC4MQpcCoJ

Score

10^/10

Malware Config

Targets

- Target
  
  noncontemptuously.exe
- Size
  
  404KB
- MD5
  
  729c57440e69f1255a83e16d8f29f182
- SHA1
  
  653e1e252dac7dafcd7fb7d09b1f739ee906216b
- SHA256
  
  e8b6c66f884a6d398bfd6e86ee4af88673a9e6f50767e195288c3bdafbaaa205
- SHA512
  
  659dbe3b4aaa173a0a85614331327825056791475eb2235b936c7bd6c4211050077c1c9a0e3e2d11900a00956faf7f937d385db30af4f61f39769a0fceee3ee0
- SSDEEP
  
  6144:h4t6Lsvq5WSBHoKC/Y3Y/kclNOmLNWnC8MwMLpXog6cjmSlJe:hkvqcSBHoKCAY/kclNOC4MQpcCoJ
Score

10^/10

azorult guloader collection discovery downloader infostealer spyware stealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  17ed1c86bd67e78ade4712be48a7d2bd
- SHA1
  
  1cc9fe86d6d6030b4dae45ecddce5907991c01a0
- SHA256
  
  bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
- SHA512
  
  0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
- SSDEEP
  
  192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  42b064366f780c1f298fa3cb3aeae260
- SHA1
  
  5b0349db73c43f35227b252b9aa6555f5ede9015
- SHA256
  
  c13104552b8b553159f50f6e2ca45114493397a6fa4bf2cbb960c4a2bbd349ab
- SHA512
  
  50d8f4f7a3ff45d5854741e7c4153fa13ee1093bafbe9c2adc60712ed2fb505c9688dd420d75aaea1b696da46b6beccc232e41388bc2a16b1f9eea1832df1cd7
- SSDEEP
  
  192:o68cSzvTyl4tgi8pPjQM0PuAg0YNyoIFtSP:LBSzm+t18pZ0WAg0RoIFg
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  b55f7f1b17c39018910c23108f929082
- SHA1
  
  1601f1cc0d0d6bcf35799b7cd15550cd01556172
- SHA256
  
  c4c6fe032f3cd8b31528d7b99661f85ee22cb78746aee98ec568431d4f5043f7
- SHA512
  
  d652f2b09396ef7b9181996c4700b25840ceaa6c1c10080a55ce3db4c25d8d85f00a21e747f9d14a3374be4cdd4ea829a18d7de9b27b13b5e304447f3e9268fa
- SSDEEP
  
  96:L7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN538:RbGgGPzxeX6D8ZyGgmkN
Score

3^/10
behavioral7 behavioral8
- Target
  
  Ovicular/Subsidence/Ukyndigt/Dioceses/megapode.app
- Size
  
  15KB
- MD5
  
  6e941ea97a92ac8ee4ac713c354c58f6
- SHA1
  
  3f23f03bf6547b2bf4b8a6eb00777a55aaf999ce
- SHA256
  
  a3a45b243179f04a923e01a8f360aafa9d628b32354453f08c0b1c31797a534b
- SHA512
  
  d2b43f6cf6d7e74c1053416213fcc35c30ca029c0c2f34de9553ad2adb92b923daf83611ba9b7b9d905ad1e60c53434dcd7ea58d3c0bf47ffa8b0e59b6cea489
- SSDEEP
  
  384:U5FKcGSrXmxrPAn8EFGftXcMOxFILjA1BoLSw9QVN/Nr:IFUAYDEwftXcMkujKo6/Nr
Score

1^/10
behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Guloader,Cloudeye

Checks computer location settings

Deletes itself

Loads dropped DLL

Reads data files stored by FTP clients

Reads local data of messenger clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9