General
- Target IMG_1005752333.exe
- Size 219KB
- Sample240604-ngjn7aeh77
- SHA256 d1832886bd31bf7129fbd708123c19bbc633e4c12bde2affabbf69236f38afad
Score
10/10
Malware Config
Extracted
Family
-
azorult
C2
-
http://hqt3.shop/DBL841/index.php
Targets
-
- Target IMG_1005752333.exe
- Size 219KB
- SHA256 d1832886bd31bf7129fbd708123c19bbc633e4c12bde2affabbf69236f38afad
Score10/10Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
Suspicious use of NtCreateUserProcessOtherParentProcess
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Drops file in System32 directory
Suspicious use of SetThreadContext