General

  • Target

    Copy0761000025pdf.exe

  • Size

    195KB

  • Sample

    240531-jj9aeacc96

  • MD5

    0089e341efa862f22d3af9894d1c5448

  • SHA1

    4d55c851eccec68786c88b064bcf35c1233393f3

  • SHA256

    bfc1cdded42adb884fb46ba53e2f023d0c27d46cf8645614094f5714ebbfb9a8

  • SHA512

    ea2c3b6cd6759b11017c58f7948d04fbafc96474190ca2162ff2486dddcd4fc83074ffd055a3367bb783475787cecb6401248344eb0cec787ef7b5dd7fb96ad4

  • SSDEEP

    3072:oiwqHidIcWy4F1qiYD56979Z9+p7NVMsvKi1EcUWAQ+iULWafUvjfH:OqCd7WrYQ979ZItNWJi1EccnbsLH

Malware Config

Extracted

Family

azorult

C2

http://hqt3.shop/DBL841/index.php

Targets

    • Target

      Copy0761000025pdf.exe

    • Size

      195KB

    • MD5

      0089e341efa862f22d3af9894d1c5448

    • SHA1

      4d55c851eccec68786c88b064bcf35c1233393f3

    • SHA256

      bfc1cdded42adb884fb46ba53e2f023d0c27d46cf8645614094f5714ebbfb9a8

    • SHA512

      ea2c3b6cd6759b11017c58f7948d04fbafc96474190ca2162ff2486dddcd4fc83074ffd055a3367bb783475787cecb6401248344eb0cec787ef7b5dd7fb96ad4

    • SSDEEP

      3072:oiwqHidIcWy4F1qiYD56979Z9+p7NVMsvKi1EcUWAQ+iULWafUvjfH:OqCd7WrYQ979ZItNWJi1EccnbsLH

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks