azorult | onetap[.]exe

General

Target
onetap.exe
Size 112KB
Sample241227-flte7asjev
SHA256 21314041b5b17d156a68d246935ab476d3532a1c9c72a39b02d98a6b7ef59473
MD5 fadf16a672e4f4af21b0e364a56897c3
SHA1 53e8b0863492525e17b5ce4ff99fb73a20544b87
SHA512 d9b756b98fcb1451431223b40e46c03f580dc713f445d3a4ff694784df3d8fff3d40985dd792d1bae717d5eca00c1471b1b628837267ee583386f5abcddac3f5
SSDEEP 3072:aixRaX6raoCoCyz6/mqv1JR+yBtGOeheWginJq:laZ1tme+1win4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

azorult

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Signatures

Azorult family
azorult

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
onetap.exe

File Explorer

onetap.exe

.exe 112KB

onetap.exe

SHA256 21314041b5b17d156a68d246935ab476d3532a1c9c72a39b02d98a6b7ef59473
MD5 fadf16a672e4f4af21b0e364a56897c3
SHA1 53e8b0863492525e17b5ce4ff99fb73a20544b87
SHA512 d9b756b98fcb1451431223b40e46c03f580dc713f445d3a4ff694784df3d8fff3d40985dd792d1bae717d5eca00c1471b1b628837267ee583386f5abcddac3f5
SSDEEP 3072:aixRaX6raoCoCyz6/mqv1JR+yBtGOeheWginJq:laZ1tme+1win4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

108164

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Sharing