Overview

overview

10

Static

static

3

c228fe269d...f6.exe

windows7-x64

7

c228fe269d...f6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c228fe269d0c65502364e0f52edee4f6

  • Size

    329KB

  • Sample

    240312-cafheacf4y

  • MD5

    c228fe269d0c65502364e0f52edee4f6

  • SHA1

    134c16febaceaf290624604eca5f2541af0827b6

  • SHA256

    464e8d4a7003d8a0b1fa1ac3329507374f8e99d6b0fa9948ae3244b7c665e12c

  • SHA512

    080b5a5930569b5ffe7873eeba16191d58a4daf3a4fdf169a2f2126f9f8fad15182138c40ef2c3a295144bfa5defd05785adcae6d9bed35de4e3e8f3cd2546ef

  • SSDEEP

    6144:VO+W8I3UJWiC3Oq4csVJemXikfcYv56Irrs62Bnt2q0sOyE:VJW8I3UJC3OHzXbkU5d2BnC

Score
10/10
azorultagilenetinfostealertrojan

Malware Config

Extracted

Family

azorult

C2

http://casiworksplcs.xyz/index.php

Targets

    • Target

      c228fe269d0c65502364e0f52edee4f6

    • Size

      329KB

    • MD5

      c228fe269d0c65502364e0f52edee4f6

    • SHA1

      134c16febaceaf290624604eca5f2541af0827b6

    • SHA256

      464e8d4a7003d8a0b1fa1ac3329507374f8e99d6b0fa9948ae3244b7c665e12c

    • SHA512

      080b5a5930569b5ffe7873eeba16191d58a4daf3a4fdf169a2f2126f9f8fad15182138c40ef2c3a295144bfa5defd05785adcae6d9bed35de4e3e8f3cd2546ef

    • SSDEEP

      6144:VO+W8I3UJWiC3Oq4csVJemXikfcYv56Irrs62Bnt2q0sOyE:VJW8I3UJC3OHzXbkU5d2BnC

    Score
    10/10
    agilenetazorultinfostealertrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks