Extracted

Extracted

Extracted

• • Target

    db3d6649e54e4dbba8452b302d9a0d1e

  • Size

    564KB

  • MD5

    db3d6649e54e4dbba8452b302d9a0d1e

  • SHA1

    ba52dfb437024c33baf1096d82695da562a3bef3

  • SHA256

    6fdb382ad598dfdda03ab66f58fe3ca549d1ab0560f6d2ee1f2c4fe6ef921566

  • SHA512

    4da0290b23f48684973539ae4caf4eb72d73954717454ef4d38949e68ac83b9129f197e426dba3fac8de5f0ea1ae35761d733d47a7de97a7dd6621c08482408f

  Score

  10^/10

  ransomwareevasionspywaretrojanstealerraccooninfostealerazorultdiscoverypersistencebotnetnetwire

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Raccoon log file

    Detects a log file produced by the Raccoon Stealer.

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Checks QEMU agent state file

    Checks state file used by QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Windows security modification

    evasiontrojan

  • Adds Run entry to start application

    persistence

  • Checks for installed software on the system

    discovery

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Modifies system certificate store

    evasionspywaretrojan

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2