Behavioral task
behavioral1
Sample
s.exe
Resource
win10-20240404-en
General
-
Target
s.exe
-
Size
112KB
-
MD5
c8b690ce8907e397382dc2cd80a2654e
-
SHA1
c24b8b6b6f6b02c0ff4aa036b47320bcfa0fef48
-
SHA256
7a2c5d70d2dd4d8cc557da080f1a7937aa62e48da44b0de6ad3743e100f7e372
-
SHA512
89ef04366a9ee948f895e8aca3335555bda7a021dab4e2f5e76f2e24cff571485e9a9d73191a96b3b8bbd45b87d286a06da04f69b9d42f8914a2dbec71b20959
-
SSDEEP
3072:KExRaQ6raoCoCyz6/mqv1JR+yBtGOeaeWgi+q:faO1tme++wix
Malware Config
Extracted
azorult
http://l0h5.shop/CM341/index.php
Signatures
-
Azorult family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource s.exe
Files
-
s.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ