azorult

General

Target
2f54973a5318c9c54fb9cee81218e6b594646929db93a1f5bfbe79280ea23a16.zip
Size 522KB
Sample241125-rwva1sxpcp
SHA256 2f54973a5318c9c54fb9cee81218e6b594646929db93a1f5bfbe79280ea23a16
MD5 c53ceed309cb110d07eb5cf1f78601cf
SHA1 60109ebfd8e950db37dc3f6d38b99e55578a1ec8
SHA512 f1c8fb507b4a9f3ae6bcfff49f72fafd555748e68f0ee2563cfc39395f742079d4e6e0ee094ad76a6925b43c73e61b64a11d69af8d5cb021018139b16ffa49ca
SSDEEP 12288:qn0L42hcrbF9s9BkBiqpXbXuS9tp6z96r8yy5HD:q0c2yrbF9sB8beSDp6BtyeHD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

azorult

C2

http://89.40.31.232/12/index.php

Targets

- Target
  Dekont#400577_89008_96634.exe
- Size 641KB
- SHA256 ffb9748a0ed7684161780e27a733f2ab11071515cc27905767813a32c8c308ff
- MD5 1d14f171fd8a6a070150c81abed8b966
- SHA1 605071e065fd88525285c736dcc5f8461a60195c
- SHA512 a337e284c26b730b72859c509decbc7d8733efd2729ae5d280558a504c6837e2546eb037edfad7b0f00c0b1c1cdd8e42728fc5e33dbb9f2a01315cbc47ab5182
- SSDEEP 12288:cT02SzNhc9bP9qhlkT+8dLb1c09/p6X9uruAK5Gi:cTbSzNy9bP9Elo1O0Fp6NBAWGi
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

azorult discovery infostealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Azorult family
  azorult
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
- MD5 564bb0373067e1785cba7e4c24aab4bf
- SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
- SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
- SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Azorult family

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4