Behavioral task
behavioral1
Sample
b0110f9ab67e182820a63c29d86bc360N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b0110f9ab67e182820a63c29d86bc360N.exe
Resource
win10v2004-20240704-en
General
-
Target
b0110f9ab67e182820a63c29d86bc360N.exe
-
Size
112KB
-
MD5
b0110f9ab67e182820a63c29d86bc360
-
SHA1
1fa738e9e9aff00dbd373f1ac31c23211b56fe88
-
SHA256
451d0e28180f8a1b376e5dbb8f5c68f737a2d2cb920c579dc604204f4b2d42ca
-
SHA512
8b7bcb6149a0307774545df166f0aa9893ed0fd33e30e8e4b265fa1042ea089137a614d68df97a1b88666ddafaff70d9437cca9ec5700b90033fc5a492780ed7
-
SSDEEP
3072:FrSXJAV3pcrUDzs1F40vdSvgSOyhRhykAX8bGxg/:FXV3mUoF40vdQgShDbG
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Signatures
-
Azorult family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource b0110f9ab67e182820a63c29d86bc360N.exe
Files
-
b0110f9ab67e182820a63c29d86bc360N.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ