AZORult spreads as a fake ProtonVPN installer
Tags
maec-delivery-vectors: Watering Hole
attack-pattern: Botnet - T1583.005 Botnet - T1584.005 Credentials - T1589.001 Malvertising - T1583.008 Malware - T1587.001 Malware - T1588.001 Server - T1583.004 Server - T1584.004 Connection Proxy - T1090
Show in Graph
Common Information
Type Value
UUID d53957f2-1f01-4f4d-bc14-13df8f151227
Fingerprint d1042b9b75274598
Analysis status DONE
Considered CTI value 2
Text language
Published Feb. 18, 2020, 10 a.m.
Added to db Feb. 17, 2023, 9:18 p.m.
Last updated Nov. 14, 2024, 2:03 p.m.
Headline AZORult spreads as a fake ProtonVPN installer
Title AZORult spreads as a fake ProtonVPN installer
Detected Hints/Tags/Attributes 22/2/10
Source URLs
Redirection Url
Details Source https://securelist.com/azorult-spreads-as-a-fake-protonvpn-installer/96261/
URL Provider
Details Provider Source level domain
Details securelist.com securelist.com
Attributes
Details Type #Events CTI Value
Details Domain 1 
protonvpn.store
Details Domain 1 
accounts.protonvpn.store
Details File 108 
0.exe
Details md5 1 
cc2477cf4d596a88b349257cba3ef356
Details md5 1 
573ff02981a5c70ae6b2594b45aa7caa
Details md5 1 
c961a3e3bd646ed0732e867310333978
Details md5 1 
2a98e06c3310309c58fb149a8dc7392c
Details md5 1 
f21c21c2fceac5118ebf088653275b4f
Details md5 1 
0ae37532a7bbce03e7686eee49441c41
Details md5 1 
974b6559a6b45067b465050e5002214b