azorult

General

Target
240818-dhsy5s1hmc_pw_infected.zip
Size 1.0MB
Sample240912-m4ehbasfmf
SHA256 94a50e2ea9ee4a32e80ddff5a860b3d07d2aa0987565ef3c12ce96f4ab95403d
MD5 44edf3fb220a2c80738d698d59f20c28
SHA1 f7bdb4e812b374e24a70fe06f7a64447bc6ff1da
SHA512 0dd7254796f0e9658e15e3665baeac507ba2c8d742c59de7ee4efbe4d4ab7cb7bcd02d9ad4c1ed82b7da38f41370d4197b64f2b222e166946866cbc84d9db3d7
SSDEEP 24576:tKV5Gv4yTWCXmUzQT59775RbZHYrjxrWQqD+DdkNkfC:0V5GbTWeUT555pxYRy8iiK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

azorult

C2

http://0x21.in:8000/_az/

Extracted

Family

quasar

Version

1.3.0.0

Botnet

EbayProfiles

C2

5.8.88.191:443
sockartek.icu:443

Mutex

QSR_MUTEX_0kBRNrRz5TDLEQouI0

Attributes

encryption_key
MWhG6wsClMX8aJM2CVXT
install_name
winsock.exe
log_directory
Logs
reconnect_delay
3000
startup_key
win defender run
subdirectory
SubDir

Targets

- Target
  240818-dhsy5s1hmc_pw_infected.zip
- Size 1.0MB
- SHA256 94a50e2ea9ee4a32e80ddff5a860b3d07d2aa0987565ef3c12ce96f4ab95403d
- MD5 44edf3fb220a2c80738d698d59f20c28
- SHA1 f7bdb4e812b374e24a70fe06f7a64447bc6ff1da
- SHA512 0dd7254796f0e9658e15e3665baeac507ba2c8d742c59de7ee4efbe4d4ab7cb7bcd02d9ad4c1ed82b7da38f41370d4197b64f2b222e166946866cbc84d9db3d7
- SSDEEP 24576:tKV5Gv4yTWCXmUzQT59775RbZHYrjxrWQqD+DdkNkfC:0V5GbTWeUT555pxYRy8iiK
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1
- Target
  964221e2d1782fa804dc6e965ee4f920N.exe
- Size 2.0MB
- SHA256 b3c2f56de0655f102fe52ba1aec7369f7a79bf37f563c5f1efe41211d26b2d09
- MD5 964221e2d1782fa804dc6e965ee4f920
- SHA1 be0fcc6e0e64cee8bf68ca0f8665b06dc26933e6
- SHA512 ab4a683dc080d1c0f5f584a20631255d47e2745305c5e116f89e5cdb636f611fd8cf28b62acca95a8ab4c224a9bc62b21208b81722383323d1357da777305bc6
- SSDEEP 24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYu:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Y0
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

azorult quasar ebayprofiles discovery infostealer spyware trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral2