Overview

overview

10

Static

static

3

c9646cb64d...e8.exe

windows7-x64

10

c9646cb64d...e8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c9646cb64d64919831475ebef3a562e8

  • Size

    354KB

  • Sample

    240314-xwq69aef98

  • MD5

    c9646cb64d64919831475ebef3a562e8

  • SHA1

    11492bfad2d8b5c437d6147847c47e1fddb5c920

  • SHA256

    0b02dbd1b4dd17aa4f3517aefc2cfb83ead088a85f9d1f2a8b26d3dd69b0c3a6

  • SHA512

    11cdfdc950838c24f64eb4720c255b872bad08f1444386f486f74046574a8d7aa32be3c17fa6ff0176b7dfd4a55a9c27df7de8001c08774f2015a993830dfe17

  • SSDEEP

    6144:yxgTOM/I1Hf9PBdIhNEhzuFuqUkQTJey+Q//4YL9FIxU8jqGUMuw:wHVP8hNEhzu4qUZfB/4U9KxVjEjw

Score
10/10
azorultevasioninfostealertrojan

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Targets

    • Target

      c9646cb64d64919831475ebef3a562e8

    • Size

      354KB

    • MD5

      c9646cb64d64919831475ebef3a562e8

    • SHA1

      11492bfad2d8b5c437d6147847c47e1fddb5c920

    • SHA256

      0b02dbd1b4dd17aa4f3517aefc2cfb83ead088a85f9d1f2a8b26d3dd69b0c3a6

    • SHA512

      11cdfdc950838c24f64eb4720c255b872bad08f1444386f486f74046574a8d7aa32be3c17fa6ff0176b7dfd4a55a9c27df7de8001c08774f2015a993830dfe17

    • SSDEEP

      6144:yxgTOM/I1Hf9PBdIhNEhzuFuqUkQTJey+Q//4YL9FIxU8jqGUMuw:wHVP8hNEhzu4qUZfB/4U9KxVjEjw

    Score
    10/10
    azorultevasioninfostealertrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Windows security modification

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

2
T1112

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks