March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – APT-C-35 aka Donot APT Group – Active IOCs
January 30, 2023
Rewterz Threat Alert – Lazarus (aka Hidden Cobra) APT Group – Active IOCs
January 30, 2023
Rewterz Threat Alert – APT-C-35 aka Donot APT Group – Active IOCs
January 30, 2023
Rewterz Threat Alert – Lazarus (aka Hidden Cobra) APT Group – Active IOCs
January 30, 2023
Severity
Medium
Analysis Summary
The AZORULT malware is an information stealer which was discovered in 2016. This malware steals IDs, browsing history, cookies, passwords, and other information. AZORult serves as a malware downloader and it was advertised on Russian underground forums as a way to extract sensitive data from compromised computers. Browser history, bitcoin, ID, cookies, and passwords can be stolen by this malware. Phishing emails and the Fallout Exploit Kit (EK), in combination with social engineering tactics, are the primary infection vectors for the AZORult virus. The virus can also act as a loader, allowing more malware to be downloaded
Impact
- Information Theft
- Credential Theft
- Exposure of Sensitive Data
Indicators of Compromise
Domain Name
- waldo.ac.ug
- 0x21.in
MD5
d7f0680063bd03e443890639c7c838f5
8334ffaac8c655b2b21ea4f04f27c7fb
63430d378c98c1817564d6a2e0642f7e
ffad999e732cd25fd6b25a404c26b85d
d46e9d619bb11aebd3f8d06195e1719b
7888711f3d11f449955d82d767ee9762
71a764c0ab0f62e0cd481f3238917330
49917bdc157bdfa508a94be4e9fe6256
268e656cb5d2686d14b5fc7655f1b0a2
SHA-256
af6521d7c089e8c6913b319c10dc79a1ee20b67fb20484d469cd6ee307dfad74
c1d0584242bb8ea02c3d85fffa62a01cfd1632ecd37bbba539cc0b33908918ca
368dc905def9aff3c3652edaf3e1f77f0bd769cc6023252f2074a8dde7ae7e7d
da6708c0e87f2f2411b3417803c0cbdac259479225aa465d6cfea3a7841c6f17
9e8ecd712a932406b1aa811d0b66105bbfe46a0c44fec31c4f68f292e5609b94
eba45a34e3dfa65dd307af9f5c018bf48aeb4a08fac42ca2899f9334b34e870b
42679e2266a9b7f207cb3e6a8a70d19c076899cadf752e3e9c87c88350789e27
b276fc4f0b6d171898f0cb332daabfe2ce22bba608013f9df0c2fc7f64f72d03
9c007a1d88135fb542b39ee84bdd7b67faf3f1e24cda4b5efc3def44a8738f18
SHA-1
3cf4c3aaf72855bb1094ebbecf825707e59e31d6
068b7a88ba7ca2313fc743d1ac61b3c06332406a
77b8664bdc60ac2dd0eb6ec6cfd99948771e69e7
10f8778880d3b5781868823a00f443c5fd71fac6
dc7f428fb088d6f4af43c89bcdb146d3ad74c26a
5fc94a3d3d7aff5884a1732ee796b3f5fdd3364b
fe99befade93749522ac55e76882743875803d49
17695f2872c52ba3b498ea2fd3f94feddd9910a9
fc6f9dca0553ce7e600e93aaf1ff32f30551ce4b
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.