General

  • Target

    adobe_illustrator_keygen_by_KeyGenGuru.zip

  • Size

    7.2MB

  • Sample

    241221-rfynha1lhn

  • MD5

    730804558db87a0e4e1dd427d0aaf45e

  • SHA1

    d14a467186017a19efaa07d67c9ce58aa343be97

  • SHA256

    92799ac72da259f2fcd7359b16b7a9beedec2384d9588ad8954ba0a3b096f126

  • SHA512

    6505083c65df317dc5b2b2027067edae793d8a46bbf148e5724903aef35039107840dcec02c223a86fcab9df99fa0dfe32575e38073e7f7bcb9df6e6ea036dcf

  • SSDEEP

    98304:RnbkSiEk/wQuriFQzHQjo1uNHVBnwMH5I5pFrRBNTAVffyXxhdLXX+xEv/6wLmmy:ipFwiFAHqN7ZG5LrvNzxhpAE6+Bc4I

Malware Config

Extracted

Family

azorult

C2

http://upqx.ru/1210776429.php

Targets

    • Target

      adobe_illustrator_keygen_by_KeyGenGuru.exe

    • Size

      7.4MB

    • MD5

      985a830153c1ffe009a634b0b041c919

    • SHA1

      6761313463d3f3174ddfbe2dc32e4596bea44594

    • SHA256

      2a12d2607a06e86780d8f8514c4dd122ad364f42a9fdde5378bd0da4708c3d3a

    • SHA512

      5c07df35119ff549713e3648ed9fbbb798db226544b9a616589ad7f0ce7be213884f72ac2999fa246c514a44726d2e36995ed2fdf39c47dcfaa8e5de76251ff5

    • SSDEEP

      196608:ehcoA1/WuwMmahoCsAlHhsoiLqu+dxytXom/GBuSPE1WKM:jo8VXhoCsArsoiyOXoT3

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Azorult family

    • Pony family

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks