General

  • Target

    f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261

  • Size

    638KB

  • Sample

    241106-ssza8ssfna

  • MD5

    bf29fb1d74335d667f7a40f94f33406c

  • SHA1

    3c94e2b216cfa76850b4528d05fce86c3849156d

  • SHA256

    f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261

  • SHA512

    26fb49c34d1e0ef2b4f49852e3158267cd3e24de128a2045f0307b1cf92445fbbf8e9a4e7f1730af54561f15a71b94c6f4417cc06b2a1634cc2acab2fdcef416

  • SSDEEP

    12288:cT02vSJpK7Z91wqowV9vc5B0vmZiNp6X9uruAK5Gi:cTbvSJsZwqow65BAhp6NBAWGi

Malware Config

Extracted

Family

azorult

C2

http://cq4cq.icu/PL341/index.php

Targets

    • Target

      f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261

    • Size

      638KB

    • MD5

      bf29fb1d74335d667f7a40f94f33406c

    • SHA1

      3c94e2b216cfa76850b4528d05fce86c3849156d

    • SHA256

      f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261

    • SHA512

      26fb49c34d1e0ef2b4f49852e3158267cd3e24de128a2045f0307b1cf92445fbbf8e9a4e7f1730af54561f15a71b94c6f4417cc06b2a1634cc2acab2fdcef416

    • SSDEEP

      12288:cT02vSJpK7Z91wqowV9vc5B0vmZiNp6X9uruAK5Gi:cTbvSJsZwqow65BAhp6NBAWGi

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Azorult family

    • Guloader family

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      564bb0373067e1785cba7e4c24aab4bf

    • SHA1

      7c9416a01d821b10b2eef97b80899d24014d6fc1

    • SHA256

      7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

    • SHA512

      22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

    • SSDEEP

      192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks