2019/10/10 Fallout EK -> AZORult

2019-10-10
#Malvertising -> #FalloutEK -> #AZORult

[Example Payload]
https://app.any.run/tasks/3c34d03a-21c3-40a8-a6f2-8f84045c0182

============================================================================
Main object- "EqwQia04.exe"
	sha256	485fc4790ac45bc26fbf984bdca2aab84b179b333163db47917fcd1164bea8c4
	sha1	8b022f5ecb6b426dac5de12e57f4d18c46f020e4
	md5	acb970b09d0569cd876cb959d63ad4a6
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-console-l1-1-0.dll	94a5df1227818edbfd0d5091c6a48f86b4117c38550343f780c604eee1cd6231
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-datetime-l1-1-0.dll	90fae0e7c3644a6754833c42b0ac39b6f23859f9a7cf4b6c8624820f59b9dad3
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-debug-l1-1-0.dll	c310cc91464c9431ab0902a561af947fa5c973925ff70482d3de017ed3f73b7d
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-errorhandling-l1-1-0.dll	a97dcca76cdb12e985dff71040815f28508c655ab2b073512e386dd63f4da325
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-file-l1-1-0.dll	7ea06b7050f9ea2bcc12af34374bdf1173646d4e5ebf66ad690b37f4df5f3d4e
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-file-l1-2-0.dll	c8c499b012d0d63b7afc8b4ca42d6d996b2fcf2e8b5f94cacfbec9e6f33e8a03
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-file-l2-1-0.dll	c85dc081b1964b77d289aac43cc64746e7b141d036f248a731601eb98f827719
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-handle-l1-1-0.dll	945cc64ee04b1964c1f9fcdc3124dd83973d332f5cfb696cdf128ca5c4cbd0e5
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-heap-l1-1-0.dll	44f6df4280c8ecc9c6e609b1a4bfee041332d337d84679cfe0d6678ce8f2998a
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-interlocked-l1-1-0.dll	deccd75fc3fc2bb31338b6fe26deffbd7914c6cd6a907e76fd4931b7d141718c
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-libraryloader-l1-1-0.dll	bb25ccf8694d1fcfce85a7159dcf6985fdb54728d29b021cb3d14242f65909ce
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-localization-l1-2-0.dll	03ad57c24ff2cf895b5f533f0ecbd10266fd8634c6b9053cc9cb33b814ad5d97
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-memory-l1-1-0.dll	bb33a9e906a5863043753c44f6f8165afe4d5edb7e55efa4c7e6e1ed90778eca
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-namedpipe-l1-1-0.dll	c4f60f911068ab6d7f578d449ba7b5b9969f08fc683fd0ce8e2705bbf061f507
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-processenvironment-l1-1-0.dll	96898930ffb338da45497be019ae1adcd63c5851141169d3023e53ce4c7a483e
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-processthreads-l1-1-0.dll	9dab884071b1f7d7a167f9bec94ba2bee875e3365603fa29b31de286c6a97a1d
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-processthreads-l1-1-1.dll	91eeb842973495deb98cef0377240d2f9c3d370ac4cf513fd215857e9f265a6a
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-profile-l1-1-0.dll	8eb5270fa99069709c846db38be743a1a80a42aa1a88776131f79e1d07cc411c
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-rtlsupport-l1-1-0.dll	2257fea1e71f7058439b3727ed68ef048bd91dcacd64762eb5c64a9d49df0b57
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-string-l1-1-0.dll	7670fdede524a485c13b11a7c878015e9b0d441b7d8eb15ca675ad6b9c9a7311
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-synch-l1-1-0.dll	5dd4ccd63e6ed07ca3987ab5634ca4207d69c47c2544dfefc41935617652820f
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-synch-l1-2-0.dll	30d99ce1d732f6c9cf82671e1d9088aa94e720382066b79175e2d16778a3dad1
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-sysinfo-l1-1-0.dll	4b704b36e1672ae02e697efd1bf46f11b42d776550ba34a90cd189f6c5c61f92
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-timezone-l1-1-0.dll	24c9aa0b70e557a49dac159c825a013a71a190df5e7a837bfa047a06bba59eca
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-core-util-l1-1-0.dll	f7d450a0f59151bcefb98d20fcae35f76029df57138002db5651d1b6a33adc86
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-crt-conio-l1-1-0.dll	9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-crt-convert-l1-1-0.dll	3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-crt-environment-l1-1-0.dll	c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-crt-filesystem-l1-1-0.dll	7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-crt-heap-l1-1-0.dll	f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-crt-locale-l1-1-0.dll	565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-crt-math-l1-1-0.dll	bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-crt-multibyte-l1-1-0.dll	66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-crt-private-l1-1-0.dll	65ded8d2ce159b2f5569f55b2caf0e2c90f3694bd88c89de790a15a49d8386b9
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-crt-process-l1-1-0.dll	c03124ba691b187917ba79078c66e12cbf5387a3741203070ba23980aa471e8b
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-crt-runtime-l1-1-0.dll	c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-crt-stdio-l1-1-0.dll	b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-crt-string-l1-1-0.dll	73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-crt-time-l1-1-0.dll	69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\api-ms-win-crt-utility-l1-1-0.dll	a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\freebl3.dll	393ae7f06fe6cd19ea6d57a93dd0acd839ee39ba386cf1ca774c4c59a3bfebd8
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\mozglue.dll	830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\msvcp140.dll	334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\nss3.dll	f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\nssdbm3.dll	541a293c450e609810279f121a5e9dfa4e924d52e8b0c6c543512b5026efe7ec
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\softokn3.dll	9a7f11c212d61856dfc494de111911b7a6d9d5e9795b0b70bbbc998896f068ae
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\ucrtbase.dll	0bb8c77de80acf9c43de59a8fd75e611cc3eb8200c69f11e94389e8af2ceb7a9
	sha256	C:\Users\admin\AppData\Local\Temp\DC2120D9\vcruntime140.dll	c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
Connections
	ip	81.177.6.14
HTTP/HTTPS requests
	url	http://81.177.6.14/index.php