Overview

overview

10

Static

static

3

0219c8eb99...6c.exe

windows7-x64

10

0219c8eb99...6c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_2394439d4b2979b67ef0ba7055c1cc9d2d12ee035d3855a00694e8efd7c8089b

  • Size

    224KB

  • Sample

    241227-ama3cawmgq

  • MD5

    9768b51e52a87198150360bbe2c415ee

  • SHA1

    ebab695d40f36bc9bf72d865def5c66cab912a3b

  • SHA256

    2394439d4b2979b67ef0ba7055c1cc9d2d12ee035d3855a00694e8efd7c8089b

  • SHA512

    f238caeb0e831232960765d9b828021875984fddd4d18ff29474538a19a10e50ce39f84742354c7aed6ee90c6dcf759a43f2f232c60abdf66f4f3531ed3d0a2d

  • SSDEEP

    6144:vZNxerUEp8rKaf2ASqISsxYZPCYYrO5aHoA/xM:xPeI5Ka+tSNxCS5aHp5M

Score
10/10
azorultdiscoveryinfostealertrojan

Malware Config

Extracted

Family

azorult

C2

http://govi.mn/temp/h/index.php

Targets

    • Target

      0219c8eb99bfcd98b292f2f2e4444fed143702b969286ed03e94751486e8276c

    • Size

      446KB

    • MD5

      11d741214fe7f5c19407c5f55693da42

    • SHA1

      73af1ff06d90109569cb4d421ed535a511101b20

    • SHA256

      0219c8eb99bfcd98b292f2f2e4444fed143702b969286ed03e94751486e8276c

    • SHA512

      247f3ab29b3dd119438602fdd63a8a56d5062ec0a7eebbfda82eba43d078d87a7233e8e314ad23c7dbb0899437759e5a06d74a0aadae00af92bef69f8abecabb

    • SSDEEP

      6144:ewgAjJigutvAbCnkZ1BPkIy0Vl3yUFoqHIe8vO:DjJAtv0BPtIrwIe2O

    Score
    10/10
    azorultdiscoveryinfostealertrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Azorult family

      azorult

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks