azorult | ec82b31675763f161fda751555a7380035c22ec767a4be9acc9e2be830967ae6 | Triage

Sharing

General

Target

c88a2260b89c314cac2b9878cde6697d
Size

419KB
Sample

240314-nx33rsbb7v
MD5

c88a2260b89c314cac2b9878cde6697d
SHA1

22034c256b0e97ed970c528c12b2c5bf3c8b83bb
SHA256

ec82b31675763f161fda751555a7380035c22ec767a4be9acc9e2be830967ae6
SHA512

34acfee1c36f6af65a91d7f53ce09cedbc8369ae597fd5962dc1b68df4e7daef453b172e10c1a14bbcc0022d7754155ce720dc70f79b461f72bee1ace04a1c74
SSDEEP

6144:+HuJC2dHSpugub26d35PKoVGM+eOkf5Q1hRT0rDS8clw1gWtDcVycV1AEf:nJCQil6dJcjeBgQHc2NWVy+1d

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://45.95.147.64/austino/index.php

Targets

- Target
  
  c88a2260b89c314cac2b9878cde6697d
- Size
  
  419KB
- MD5
  
  c88a2260b89c314cac2b9878cde6697d
- SHA1
  
  22034c256b0e97ed970c528c12b2c5bf3c8b83bb
- SHA256
  
  ec82b31675763f161fda751555a7380035c22ec767a4be9acc9e2be830967ae6
- SHA512
  
  34acfee1c36f6af65a91d7f53ce09cedbc8369ae597fd5962dc1b68df4e7daef453b172e10c1a14bbcc0022d7754155ce720dc70f79b461f72bee1ace04a1c74
- SSDEEP
  
  6144:+HuJC2dHSpugub26d35PKoVGM+eOkf5Q1hRT0rDS8clw1gWtDcVycV1AEf:nJCQil6dJcjeBgQHc2NWVy+1d
Score

10^/10

azorult infostealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2

azorultinfostealertrojan