azorult

General

Target

HSBC_PAYMENT.exe
Size

838KB
Sample

240725-hw4d9axgnc
MD5

012a8c2d8d89f5a899644738b1dbeddf
SHA1

0b2c6fdc0a100726884d239429fef4bba6208071
SHA256

81645015b100a9f7759fa73ef49879ff9be5795c3b073516c3e1a040af057c7f
SHA512

cd8968f5a4bcce5882d55f95361c3ea6889be04794ba93405bfc64c1881e607073ce20861b2bdafc3a10639ce87073a701148d6be040648ea98686aa2d078df5
SSDEEP

24576:nYDoeMwkejuoLD9B9qwZXfOOu4WK7wZ36BDB:YdMErLRjqwZXmOH/7wZqBd

Score

10^/10

Malware Config

Targets

- Target
  
  HSBC_PAYMENT.exe
- Size
  
  838KB
- MD5
  
  012a8c2d8d89f5a899644738b1dbeddf
- SHA1
  
  0b2c6fdc0a100726884d239429fef4bba6208071
- SHA256
  
  81645015b100a9f7759fa73ef49879ff9be5795c3b073516c3e1a040af057c7f
- SHA512
  
  cd8968f5a4bcce5882d55f95361c3ea6889be04794ba93405bfc64c1881e607073ce20861b2bdafc3a10639ce87073a701148d6be040648ea98686aa2d078df5
- SSDEEP
  
  24576:nYDoeMwkejuoLD9B9qwZXfOOu4WK7wZ36BDB:YdMErLRjqwZXmOH/7wZqBd
Score

10^/10

discovery execution azorult collection credential_access infostealer spyware stealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2