azorult | 92e57cd12c6fa4d6686aaa19021f092c86ebb439d5a087e65a7b3b05b0ad1ae1 | Triage

Sharing

General

Target

92e57cd12c6fa4d6686aaa19021f092c86ebb439d5a087e65a7b3b05b0ad1ae1.gz
Size

46KB
Sample

240809-xpa7fsvapm
MD5

a99917b8909cb4e2b44a8b4e5bdef022
SHA1

5415adb67c40afe8c778d1355934c645ebc85a03
SHA256

92e57cd12c6fa4d6686aaa19021f092c86ebb439d5a087e65a7b3b05b0ad1ae1
SHA512

d7071241a6fdea66a889b9d18bb4f3c969990a8e77d513998f0cb042cdefc8720109c4c249b12676efb6c79aecd26492478bd9ce47212b200a52cffe030119e4
SSDEEP

768:i/eantMENkxsDvbC/dHre0LusGKH2WD2pQ4+gWQmtioyhcNEvL3k4q/Z7vHLu:iTMXybydLDLusJPiHuVjScuvrOY

Score

10^/10

azorult discovery infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://l0h5.shop/CM341/index.php

Targets

- Target
  
  ACCEPT_014STSY529093.PDF.exe
- Size
  
  108KB
- MD5
  
  996817a2a2c9afe0a459bd0cc9a68d74
- SHA1
  
  23770e473ea88638874473b631602f437a799760
- SHA256
  
  a50376b1375f041a534a74ea0cecd6429b4e26747059a4a4c72ef91bb04d7080
- SHA512
  
  24a7cdcaf49b9d565da4df977b084f0b94c82f33f1dd80621e649040baa85565aef9cb147036674ec57f3586e3038cdafacbdb6724e61a651c168359deda1df1
- SSDEEP
  
  3072:6dS3TaTBi6I/TPDe3R2/8fDvDySHzDed:65i7TSB2abGSH
Score

10^/10

azorult discovery infostealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

azorultdiscoveryinfostealertrojan