Overview

overview

10

Static

static

10

cb1fef1a16...d9.exe

windows7-x64

10

cb1fef1a16...d9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cb1fef1a16b7fc3851b569ffb51e17d9

  • Size

    353KB

  • Sample

    240315-l4ebwadf9x

  • MD5

    cb1fef1a16b7fc3851b569ffb51e17d9

  • SHA1

    00373b44ad8558dd23832f3aba6b031acbad706e

  • SHA256

    bdd500e8d7fadf83d80b3e1e6affbf60af92dff9d0b902b353e6ddad657445da

  • SHA512

    0e1650bc41854d87dbef66870e300b52b6bf5fdd66af7753098d3711acea1deae18241cad26b7839bcfbd4a0eccadbec3502b613046cc0a1de3b1b3649d8d016

  • SSDEEP

    6144:36wEc0lyFFVFCTkeiNRTD2dWlKItfK6ioAjVQ5qvfJX73aAtxzxCmJ1X3XCjC6:KwEZuFVk4eiHCiKWfooAjGovfND5xzxP

Score
10/10
azorultzgratinfostealerrattrojan

Malware Config

Extracted

Family

azorult

C2

http://203.159.80.118/PL341/index.php

Targets

    • Target

      cb1fef1a16b7fc3851b569ffb51e17d9

    • Size

      353KB

    • MD5

      cb1fef1a16b7fc3851b569ffb51e17d9

    • SHA1

      00373b44ad8558dd23832f3aba6b031acbad706e

    • SHA256

      bdd500e8d7fadf83d80b3e1e6affbf60af92dff9d0b902b353e6ddad657445da

    • SHA512

      0e1650bc41854d87dbef66870e300b52b6bf5fdd66af7753098d3711acea1deae18241cad26b7839bcfbd4a0eccadbec3502b613046cc0a1de3b1b3649d8d016

    • SSDEEP

      6144:36wEc0lyFFVFCTkeiNRTD2dWlKItfK6ioAjVQ5qvfJX73aAtxzxCmJ1X3XCjC6:KwEZuFVk4eiHCiKWfooAjGovfND5xzxP

    Score
    10/10
    azorultzgratinfostealerrattrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks