azorult | 98d1d0dec7c6d45c100a186f16ff8d01ed6b86e0794edfdeda419958725f38ce

General

Target
jaffacakes118_Trojan-PSW.Win32.Azorult.plv.397673c0dadbf05eba04c993526db735
Size 750KB
Sample261012-htw76ahc25
SHA256 98d1d0dec7c6d45c100a186f16ff8d01ed6b86e0794edfdeda419958725f38ce
MD5 397673c0dadbf05eba04c993526db735
SHA1 f10cba0139d61edf546c3ec2ae50bee5f652cd4d
SHA512 7ccbe68d8939d09c19f9ed36fcca42198a311719db71db62bc0d8862585f507e023b6cd2e5b08c8dbc422a96d35ac52082f0f3ef14c8b6ceee3934463f09b2df
SSDEEP 12288:mYV6MorX7qzuC3QHO9FQVHPF51jgct+oqp5jQ/6qtyh4UlQ41TyMIVqxJyR:lBXu9HGaVHtKp5jQ6ht7OnVqTyR
TLSH
T19CF4DFA07217324CF8293D32DC7A217865F32E91D1FD9A5D83AC7639183278499BA5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

azorult

C2

http://144.217.174.59/index.php

Targets

- Target
  jaffacakes118_Trojan-PSW.Win32.Azorult.plv.397673c0dadbf05eba04c993526db735
- Size 750KB
- SHA256 98d1d0dec7c6d45c100a186f16ff8d01ed6b86e0794edfdeda419958725f38ce
- MD5 397673c0dadbf05eba04c993526db735
- SHA1 f10cba0139d61edf546c3ec2ae50bee5f652cd4d
- SHA512 7ccbe68d8939d09c19f9ed36fcca42198a311719db71db62bc0d8862585f507e023b6cd2e5b08c8dbc422a96d35ac52082f0f3ef14c8b6ceee3934463f09b2df
- SSDEEP 12288:mYV6MorX7qzuC3QHO9FQVHPF51jgct+oqp5jQ/6qtyh4UlQ41TyMIVqxJyR:lBXu9HGaVHtKp5jQ6ht7OnVqTyR
- TLSH
  T19CF4DFA07217324CF8293D32DC7A217865F32E91D1FD9A5D83AC7639183278499BA5FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery azorult infostealer trojan upx
- Family: Azorult
  An information stealer that was first discovered in 2016, targeting browsing history and passwords.
  trojan infostealer azorult
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Azorult

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2