azorult

General

Target

Est_US091024A - PICTURE.exe
Size

595KB
Sample

240916-md8ngascpe
MD5

5993ff93b68cf1f66f13d073ef61eaa6
SHA1

26be0e107ee83ed8cf3e04fcd0937e0be5228ea1
SHA256

b0b62e7ff94d68b2352f690236d7d8dc8d40113b2a18102f1e6a9492fd6bf2e7
SHA512

7dccaaea5938b89148c32054616c24d75e32386c503b6953534bc2188b9918075078cc63ba6bce1f923b5d204235c8d220b96a3cc8139187b9c02e70673535a8
SSDEEP

12288:iBIJsQVBWutWAgYOb07EE5dN9Wqes1rgGiuOCCS:LJsQVZ+bz8dN9WX9lwCS

Score

10^/10

Malware Config

Targets

- Target
  
  Est_US091024A - PICTURE.exe
- Size
  
  595KB
- MD5
  
  5993ff93b68cf1f66f13d073ef61eaa6
- SHA1
  
  26be0e107ee83ed8cf3e04fcd0937e0be5228ea1
- SHA256
  
  b0b62e7ff94d68b2352f690236d7d8dc8d40113b2a18102f1e6a9492fd6bf2e7
- SHA512
  
  7dccaaea5938b89148c32054616c24d75e32386c503b6953534bc2188b9918075078cc63ba6bce1f923b5d204235c8d220b96a3cc8139187b9c02e70673535a8
- SSDEEP
  
  12288:iBIJsQVBWutWAgYOb07EE5dN9Wqes1rgGiuOCCS:LJsQVZ+bz8dN9WX9lwCS
Score

10^/10

azorult guloader collection credential_access discovery downloader execution infostealer spyware stealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2