General

  • Target

    b0e4252490af0fd5cebf565ec1c74dc42f75e5cfe3a5d1cc35f71d93e780e1de.exe

  • Size

    1.1MB

  • Sample

    250217-jes3mavrfx

  • MD5

    a3b7b54ee9edc1b94be4aee9e9c4def6

  • SHA1

    bab053cd2ec6f3e1ee287149f825a43af766142f

  • SHA256

    b0e4252490af0fd5cebf565ec1c74dc42f75e5cfe3a5d1cc35f71d93e780e1de

  • SHA512

    3d0c9a733e3753d62c035027cf048e6cf07870185e5fc3a5e82199956fdf2a06789d4a31c4913e41afd3fe13eee61b4b0b5f5eba0df8f9b0216bfbb2a0eedf15

  • SSDEEP

    24576:MAHnh+eWsN3skA4RV1Hom2KXMmHa0cH6Ww/aRf+j5s:rh+ZkldoPK8Ya022s

Malware Config

Extracted

Family

azorult

C2

http://parcelinn.com/wp-content/images/index.php

Targets

    • Target

      b0e4252490af0fd5cebf565ec1c74dc42f75e5cfe3a5d1cc35f71d93e780e1de.exe

    • Size

      1.1MB

    • MD5

      a3b7b54ee9edc1b94be4aee9e9c4def6

    • SHA1

      bab053cd2ec6f3e1ee287149f825a43af766142f

    • SHA256

      b0e4252490af0fd5cebf565ec1c74dc42f75e5cfe3a5d1cc35f71d93e780e1de

    • SHA512

      3d0c9a733e3753d62c035027cf048e6cf07870185e5fc3a5e82199956fdf2a06789d4a31c4913e41afd3fe13eee61b4b0b5f5eba0df8f9b0216bfbb2a0eedf15

    • SSDEEP

      24576:MAHnh+eWsN3skA4RV1Hom2KXMmHa0cH6Ww/aRf+j5s:rh+ZkldoPK8Ya022s

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Azorult family

    • Downloads MZ/PE file

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks