Rewterz Threat Alert –ServHelper Backdoor – Active IOCs
July 27, 2021Rewterz Threat Alert – FormBook Malware – Active IOCs
July 27, 2021Rewterz Threat Alert –ServHelper Backdoor – Active IOCs
July 27, 2021Rewterz Threat Alert – FormBook Malware – Active IOCs
July 27, 2021Severity
Medium
Analysis Summary
AZORult is a payment card and credential information stealer. It was sold on Russian underground forums as a means to collect sensitive information from infected systems. The malware is also able to steal cookies, browsing history, cryptocurrency, and ID/passwords. Exploits such as phishing emails and Fallout Exploit Kit (EK) paired with social engineering techniques are major infection vectors of the AZORult malware. The malware can also be used as a loader to download other malware.
Impact
- Information Theft
- Credential Theft
- Exposure of Sensitive Data
Indicators of Compromise
MD5
- 82be3b738b7b375f53a4bef3a37e4585
- 37fb9ee65758519d474bb478d98e726c
- 40c69c72bb95c7370a0e75e299370b77
- 8791a2b797c21d7830ea9ac9a8a5a5bd
- f4c0f47027ea961b2c3276fe4e2f2ede
- a9bfcb72b99376b9e9cb907d4d0ca390
- 180752c30cb36ad2320cdb74e36fb5a6
SHA-256
- 120fcd098c502894515feb3814bd6edc34ceb13648dcfae2a22c4f4e2166ace2
- b1eabb9ee4a7512da2beba587500936233aa63c4c210ca99ceafef24ca7b1976
- aae9e232abe6255663d52d2db42079a395e3e50f712b8a39f269116ed419f8c6
- 20ab52e4380262d3d83ddf0898b715d72d1feca497c566bfb952824cd6c76bc1
- 462f4e639cead04d64436b603d4e0a62816fcaa0b03c6390d6f2c6ff366da6c7
- c641763cf38618078eb1b366c251f26d6ae8f13ab5bbd9e83963df3bd88eaa14
- 342115e2b3702673e9f1baf63f0d801598b525b66388fd6af88a1a4666228482
SHA-1
- 417c1f005b106dbf326614ba4ac9c41c83abb267
- 2c714652b562b522bd763163a0fb59b995d3b00d
- 175087791edda7cacdf409c125fe3f0307d5a1df
- 64fb146114087b4bcc1fa0ca069bd936bfd81d8e
- 3c7259b2d9d56ed1cac3e497ecb6d4e376d29e24
- ba6fd7b093efc1c536d5f65ab601ca6d17c92f0f
- cdbc44d5365f4abaf6d093d6e78185370565f8a2
URL
- https[:]//keygensumo[.]com/sy/warez/
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.