azorult

Sharing

Copy URL

Twitter E-mail

General

Target

DHL AWB#3253606333.exe
Size

618KB
Sample

240129-q2y1qacegq
MD5

a4b327279c518e993dfda593e6e7e7a7
SHA1

59edf5766c1b2b2aeace7776b0a8a09321a3ad66
SHA256

b05f39f081d71f68d4209214f0c44f3f3e0d68e2552c662e3dbe6cd2d788ff65
SHA512

78006ea73c5b634bc8b37f2a52c057df10be6a8b76e8b5c06eb0d92ad50faf6b82ebddb2dc57dd3a5fad5996c35dfd8ce5e0b125c857ea072b5a6bf38ecbc69c
SSDEEP

12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLpe4jL:AQy6ONsqLpe4mDZ2KzmXTrb

Score

10^/10

Malware Config

Targets

- Target
  
  DHL AWB#3253606333.exe
- Size
  
  618KB
- MD5
  
  a4b327279c518e993dfda593e6e7e7a7
- SHA1
  
  59edf5766c1b2b2aeace7776b0a8a09321a3ad66
- SHA256
  
  b05f39f081d71f68d4209214f0c44f3f3e0d68e2552c662e3dbe6cd2d788ff65
- SHA512
  
  78006ea73c5b634bc8b37f2a52c057df10be6a8b76e8b5c06eb0d92ad50faf6b82ebddb2dc57dd3a5fad5996c35dfd8ce5e0b125c857ea072b5a6bf38ecbc69c
- SSDEEP
  
  12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLpe4jL:AQy6ONsqLpe4mDZ2KzmXTrb
Score

10^/10

azorult collection discovery infostealer spyware stealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  17ed1c86bd67e78ade4712be48a7d2bd
- SHA1
  
  1cc9fe86d6d6030b4dae45ecddce5907991c01a0
- SHA256
  
  bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
- SHA512
  
  0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
- SSDEEP
  
  192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
Score

3^/10
behavioral3 behavioral4
- Target
  
  Adits148/Udalman/Sensationalising/Caducities/vtablog.dll
- Size
  
  268KB
- MD5
  
  35119e61479373ba5d7433f106556e79
- SHA1
  
  096a7d227eb2514d76ec5d10bfd1cf165d4a9177
- SHA256
  
  f21d9de02c67e51bb9f7163f676f2d4710b2befae04fd0751a63cf1278c48a3c
- SHA512
  
  21318d0924393c8269419df5acc0c07ca2f754fd9d9ad80d393cf7ebec1b16986d123f2775ae210383b7faa106ed84e829c949004a123da844c07f2b46387453
- SSDEEP
  
  3072:s1vaCg+eY9yp71driAAYBnk/+eeaQyJen3n83fucakiD88iryUBw:ovDgZYq/rzfNufuceD5UBw
Score

1^/10
behavioral5 behavioral6
- Target
  
  keywords.txt
- Size
  
  1010B
- MD5
  
  4d3c8d141484bbb0b8be03c13894ec9f
- SHA1
  
  1fbb29a4d6a1f48745e6d67bfa110306bc54c6ba
- SHA256
  
  c74e743057bfb38a767f3666df1d16587e2e529a070d1621be0e737366011471
- SHA512
  
  e4b9dd5c3585c24301ac71d7849616d680b25d2b340192c31c3de38a9546564cb30aa1b08bdbcba9e3b87303cd5f3bdb93e37c399bc9d056a68b9bbc7a0a3329
Score

1^/10
behavioral7 behavioral8

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Deletes itself

Loads dropped DLL

Reads data files stored by FTP clients

Reads local data of messenger clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8