azorult

General

Target

99d1661adfbaf9cd2d4bdbeec165786a
Size

3.1MB
Sample

240213-wx8bgsga83
MD5

99d1661adfbaf9cd2d4bdbeec165786a
SHA1

ae498e890be1c7047c28d29d51fe27712efbb871
SHA256

5785ad85a293567163d30e6dc31f0c9bdf62f0c39ea84bcf92f1e3884d0cb33d
SHA512

c49d961d0528847bffa2b5935e0378c6bf87886fbe7db90bdc756e1580c6b21651ebe61bfa56bfbce00d44f5f8fd471868b5129346a19bbb5bba22adfaef75f1
SSDEEP

98304:wdNIA2b8lIpIta0Icq+KPtYulORjiCSHwdlPtqM7RcS4FIKU21IEfrNdSf8M:wdNB4ianUstYuUR2CSHsVP8M

Score

10^/10

Malware Config

Extracted

Family

netwire

C2

174.127.99.159:7882

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
May-B
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
false

Extracted

Family

azorult

C2

https://gemateknindoperkasa.co.id/imag/index.php

Targets

- Target
  
  99d1661adfbaf9cd2d4bdbeec165786a
- Size
  
  3.1MB
- MD5
  
  99d1661adfbaf9cd2d4bdbeec165786a
- SHA1
  
  ae498e890be1c7047c28d29d51fe27712efbb871
- SHA256
  
  5785ad85a293567163d30e6dc31f0c9bdf62f0c39ea84bcf92f1e3884d0cb33d
- SHA512
  
  c49d961d0528847bffa2b5935e0378c6bf87886fbe7db90bdc756e1580c6b21651ebe61bfa56bfbce00d44f5f8fd471868b5129346a19bbb5bba22adfaef75f1
- SSDEEP
  
  98304:wdNIA2b8lIpIta0Icq+KPtYulORjiCSHwdlPtqM7RcS4FIKU21IEfrNdSf8M:wdNB4ianUstYuUR2CSHsVP8M
Score

10^/10

azorult netwire botnet infostealer rat stealer trojan upx
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

NetWire RAT payload

Netwire

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2