azorult

General

Target

9fc3e5815cca7d86bdb923c9218dbf56
Size

3.1MB
Sample

240216-h6lbesch7y
MD5

9fc3e5815cca7d86bdb923c9218dbf56
SHA1

9168c3d45d800d42bd0dfda578238a298f8d7ecb
SHA256

412277aed22086315a5693c3b09805b4dd1a944e66521386bd54faddd99df31f
SHA512

75b0125c3812838ac1762b854602f31b1a1e9497a08a7122da8c12b6d3c0e1178dc377a695ef705b5d443ac064c20933a8814ea6c54ba31dbc815014792b46f3
SSDEEP

98304:rdNIA2b8lIpIta0Icq+KPtYulORjiCSHwdlPtqM7RcS4FIKU21IEfrNdSf8u:rdNB4ianUstYuUR2CSHsVP8u

Score

10^/10

Malware Config

Extracted

Family

netwire

C2

174.127.99.159:7882

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
May-B
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
false

Extracted

Family

azorult

C2

https://gemateknindoperkasa.co.id/imag/index.php

Targets

- Target
  
  9fc3e5815cca7d86bdb923c9218dbf56
- Size
  
  3.1MB
- MD5
  
  9fc3e5815cca7d86bdb923c9218dbf56
- SHA1
  
  9168c3d45d800d42bd0dfda578238a298f8d7ecb
- SHA256
  
  412277aed22086315a5693c3b09805b4dd1a944e66521386bd54faddd99df31f
- SHA512
  
  75b0125c3812838ac1762b854602f31b1a1e9497a08a7122da8c12b6d3c0e1178dc377a695ef705b5d443ac064c20933a8814ea6c54ba31dbc815014792b46f3
- SSDEEP
  
  98304:rdNIA2b8lIpIta0Icq+KPtYulORjiCSHwdlPtqM7RcS4FIKU21IEfrNdSf8u:rdNB4ianUstYuUR2CSHsVP8u
Score

10^/10

azorult netwire botnet infostealer rat stealer trojan upx
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

NetWire RAT payload

Netwire

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

UPX packed file

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2