General
-
Target
21ff26bcc1f11e4cdff0a08eb6ca2b617f27e84476bcadfcdf946fcb9baaaa34.exe
-
Size
839KB
-
Sample
240723-srjt6awhkn
-
MD5
8332816fb3dba886718acb8f6a9f2861
-
SHA1
dc8dcc1bfbcde022c91b30841c6691e4a4e4cb1c
-
SHA256
21ff26bcc1f11e4cdff0a08eb6ca2b617f27e84476bcadfcdf946fcb9baaaa34
-
SHA512
f6a78c95c2ac475d7d27bdd6220313344c8b910ed456b5e0a39610b69fd8360b63bcaf69a99bc5185b06cf7d9c6133b6f9736f25a16ea35e5e4626c411fcbce7
-
SSDEEP
12288:8t7ExDo//OtX1lxawkeVCGmQzVuoLZJat+8kWEP59h7geXULKC24/2ZJkasF1rbE:4YDoeMwkejuoLD4+8ej1k/2rkaMrzrQ
Malware Config
Targets
-
-
Target
21ff26bcc1f11e4cdff0a08eb6ca2b617f27e84476bcadfcdf946fcb9baaaa34.exe
-
Size
839KB
-
MD5
8332816fb3dba886718acb8f6a9f2861
-
SHA1
dc8dcc1bfbcde022c91b30841c6691e4a4e4cb1c
-
SHA256
21ff26bcc1f11e4cdff0a08eb6ca2b617f27e84476bcadfcdf946fcb9baaaa34
-
SHA512
f6a78c95c2ac475d7d27bdd6220313344c8b910ed456b5e0a39610b69fd8360b63bcaf69a99bc5185b06cf7d9c6133b6f9736f25a16ea35e5e4626c411fcbce7
-
SSDEEP
12288:8t7ExDo//OtX1lxawkeVCGmQzVuoLZJat+8kWEP59h7geXULKC24/2ZJkasF1rbE:4YDoeMwkejuoLD4+8ej1k/2rkaMrzrQ
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Loads dropped DLL
-
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-