General
-
Target
s.exe
-
Size
112KB
-
Sample
240826-bqafnaycpl
-
MD5
c8b690ce8907e397382dc2cd80a2654e
-
SHA1
c24b8b6b6f6b02c0ff4aa036b47320bcfa0fef48
-
SHA256
7a2c5d70d2dd4d8cc557da080f1a7937aa62e48da44b0de6ad3743e100f7e372
-
SHA512
89ef04366a9ee948f895e8aca3335555bda7a021dab4e2f5e76f2e24cff571485e9a9d73191a96b3b8bbd45b87d286a06da04f69b9d42f8914a2dbec71b20959
-
SSDEEP
3072:KExRaQ6raoCoCyz6/mqv1JR+yBtGOeaeWgi+q:faO1tme++wix
Behavioral task
behavioral1
Sample
s.exe
Resource
win10-20240404-en
Malware Config
Extracted
azorult
http://l0h5.shop/CM341/index.php
Targets
-
-
Target
s.exe
-
Size
112KB
-
MD5
c8b690ce8907e397382dc2cd80a2654e
-
SHA1
c24b8b6b6f6b02c0ff4aa036b47320bcfa0fef48
-
SHA256
7a2c5d70d2dd4d8cc557da080f1a7937aa62e48da44b0de6ad3743e100f7e372
-
SHA512
89ef04366a9ee948f895e8aca3335555bda7a021dab4e2f5e76f2e24cff571485e9a9d73191a96b3b8bbd45b87d286a06da04f69b9d42f8914a2dbec71b20959
-
SSDEEP
3072:KExRaQ6raoCoCyz6/mqv1JR+yBtGOeaeWgi+q:faO1tme++wix
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
7Credentials In Files
6Credentials in Registry
1