General

  • Target

    65e1b5713b271302e96bab80440f744c13c953749562603ea3ee03eda880f9ea.exe

  • Size

    1.0MB

  • Sample

    240906-bq2vxaybrp

  • MD5

    97cc0e7d7caa3483e4c5e5cff9fbe67e

  • SHA1

    e74e03ad3d8f52ce5858a5e8208343fa04a2b367

  • SHA256

    65e1b5713b271302e96bab80440f744c13c953749562603ea3ee03eda880f9ea

  • SHA512

    320b84be5ade8681a0be7bd862dfa1b65f75189cc95967ed586d9efdb3c68a8f243861c399339b42f9688561c2f217a6e9d8e4b2e586a4d4f2f583eca711c357

  • SSDEEP

    24576:OLPskXqS0jFC6LkpzqPskXqS0jFC6LkpzWoKywypSpbYmb93PK/:QJXUJC6LkpzqJXUJC6LkpzEMSNYmpy/

Malware Config

Extracted

Family

azorult

C2

https://ehzwq.shop/erd/mac/index.php

Targets

    • Target

      65e1b5713b271302e96bab80440f744c13c953749562603ea3ee03eda880f9ea.exe

    • Size

      1.0MB

    • MD5

      97cc0e7d7caa3483e4c5e5cff9fbe67e

    • SHA1

      e74e03ad3d8f52ce5858a5e8208343fa04a2b367

    • SHA256

      65e1b5713b271302e96bab80440f744c13c953749562603ea3ee03eda880f9ea

    • SHA512

      320b84be5ade8681a0be7bd862dfa1b65f75189cc95967ed586d9efdb3c68a8f243861c399339b42f9688561c2f217a6e9d8e4b2e586a4d4f2f583eca711c357

    • SSDEEP

      24576:OLPskXqS0jFC6LkpzqPskXqS0jFC6LkpzWoKywypSpbYmb93PK/:QJXUJC6LkpzqJXUJC6LkpzEMSNYmpy/

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks