Overview

overview

10

Static

static

1

.html

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    .

  • Size

    146KB

  • Sample

    240401-hyfqzagf48

  • MD5

    4a34f0fe376769a3f7d9929d789098f8

  • SHA1

    eb79a7c4b9899c43bfcf1f8c0cbd388fc1e14472

  • SHA256

    d20abd749e459f34d62daeed2e23443883d9eec5e58e578513a92420bb69974b

  • SHA512

    a7796fb412fd2c874b75843771d95ad947b0dba60447b054a7c7f7a8ad3fb2dd992f419f18360b09517d0317daadd3daa1efc3aab89d35ad3558442b81828f70

  • SSDEEP

    1536:o4kyd8LFVMUK4DgnVR4DBllKoVkL30vD9329s4D+HhqiE:BkzLFoVsllXmxYHhqiE

Score
10/10
azorultrmsaspackv2evasioninfostealerpersistencerattrojanupx

Malware Config

Extracted

Family

azorult

C2

http://boglogov.site/index.php

Targets

    • Target

      .

    • Size

      146KB

    • MD5

      4a34f0fe376769a3f7d9929d789098f8

    • SHA1

      eb79a7c4b9899c43bfcf1f8c0cbd388fc1e14472

    • SHA256

      d20abd749e459f34d62daeed2e23443883d9eec5e58e578513a92420bb69974b

    • SHA512

      a7796fb412fd2c874b75843771d95ad947b0dba60447b054a7c7f7a8ad3fb2dd992f419f18360b09517d0317daadd3daa1efc3aab89d35ad3558442b81828f70

    • SSDEEP

      1536:o4kyd8LFVMUK4DgnVR4DBllKoVkL30vD9329s4D+HhqiE:BkzLFoVsllXmxYHhqiE

    Score
    10/10
    azorultrmsaspackv2evasioninfostealerpersistencerattrojanupx

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

      evasion

    • Downloads MZ/PE file

    • Stops running service(s)

      evasion

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Modifies WinLogon

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

5
T1112

Impair Defenses

4
T1562

Disable or Modify Tools

3
T1562.001

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Service Stop

1
T1489

Resource Development

Reconnaissance

Tasks