azorult | c17cce7b76e77115acdb04c82c953fe959119d81edf4d283c7ffa0a42913ebe7 | Triage

Sharing

General

Target

6a0b4eb3267d2fa1e437149b1f771fe0JaffaCakes118
Size

819KB
Sample

240526-fhcy2agc98
MD5

6a0b4eb3267d2fa1e437149b1f771fe0
SHA1

8bf98da0d6d5829549f6ae81f77516bbaaaf861d
SHA256

c17cce7b76e77115acdb04c82c953fe959119d81edf4d283c7ffa0a42913ebe7
SHA512

03dff45adc2409577ac5ebbdc4ee1041fa4b052344793ee04798aaf8e689d0cca9ea292adb4a031d9d131ece664f6c0db65be533e69dd1b2a662b28ce329bbd7
SSDEEP

12288:OK2mhAMJ/cPlbVwPCUemfL74xCaC0oAa4QOCLsn2lwnlZwL0ZApuA3bDtWt:f2O/GlbHjmz77a8OCLs2lQlZP69s

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://u-ri.icu/index.php

Targets

- Target
  
  6a0b4eb3267d2fa1e437149b1f771fe0JaffaCakes118
- Size
  
  819KB
- MD5
  
  6a0b4eb3267d2fa1e437149b1f771fe0
- SHA1
  
  8bf98da0d6d5829549f6ae81f77516bbaaaf861d
- SHA256
  
  c17cce7b76e77115acdb04c82c953fe959119d81edf4d283c7ffa0a42913ebe7
- SHA512
  
  03dff45adc2409577ac5ebbdc4ee1041fa4b052344793ee04798aaf8e689d0cca9ea292adb4a031d9d131ece664f6c0db65be533e69dd1b2a662b28ce329bbd7
- SSDEEP
  
  12288:OK2mhAMJ/cPlbVwPCUemfL74xCaC0oAa4QOCLsn2lwnlZwL0ZApuA3bDtWt:f2O/GlbHjmz77a8OCLs2lQlZP69s
Score

10^/10

azorult infostealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

azorultinfostealertrojan

behavioral2