azorult | f5c41dc570c2856411bbbf4bd3a0adea62ae1236aa9dbaba5d5eda703cde8996 | Triage

Sharing

General

Target

JaffaCakes118_f5c41dc570c2856411bbbf4bd3a0adea62ae1236aa9dbaba5d5eda703cde8996
Size

232KB
Sample

241230-y4j9caxkak
MD5

bf655fea65c401a0e9578ee4e318d95d
SHA1

943f51c27b651a390459e4e884749b6ec077f6c1
SHA256

f5c41dc570c2856411bbbf4bd3a0adea62ae1236aa9dbaba5d5eda703cde8996
SHA512

5a4472980807858247a6d505305748c0f651bf0755158a88723b3e0b52f06947e679bf72ec1a769753b6cd204891d4ab4697b476f5ec908c99bd7116904bc78b
SSDEEP

3072:iGYXT8djV71S8OVgXlr7YQT2Ej8q8w/0HmaElXJCBUF/QKwVuFIK9jc9QItfrMyo:lYIBSbg1rh2tw9aEcjgNpItfQlby1KZz

Score

10^/10

azorult discovery infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://elovisboy.com/PL341/index.php

Targets

- Target
  
  8f37d7794a2db98bb5f91866789ee2280e543528afecdd68ffbc28284ce8bd20
- Size
  
  250KB
- MD5
  
  c39f584192e8b2d28397c12141e4a5f5
- SHA1
  
  03f648eb6d652b9798418b9144505d88ff92a8fa
- SHA256
  
  8f37d7794a2db98bb5f91866789ee2280e543528afecdd68ffbc28284ce8bd20
- SHA512
  
  69158bad400ff0f3e3e4b32c024a07660c36900d72c009faf71bd2586d9972cd55b466030ea0ed7b5754cb95237f98c6a5a5fdc2eeb0553c2da01ba577c66d3e
- SSDEEP
  
  6144:bL9bP2GhN3+ZfJW/ZYM964kKIVGP2QJhHgKFj8XwW5d:bV2iNT44kKIVGP2QJ5gK2wW5
Score

10^/10

azorult discovery infostealer trojan
- Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- Azorult family
  azorult
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

azorultdiscoveryinfostealertrojan

behavioral2

azorultdiscoveryinfostealertrojan