Extracted

• • Target
    12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe
  • Size 211KB
  • SHA256 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589
  • MD5 ae45cb818157138c24bae1d53018da0f
  • SHA1 0221a4ed545e1095a6cf0d7ba06d08d827d22207
  • SHA512 e3ec8b54ec37437656e48d02bfa19d1db218d92e710263fa8602467592c5f8432213921086a69fb6d5a78a77ba213143b2ec3d6b90651268e43eb7647dab8b62
  • MD5 SHA1 SHA512

  Score

  10^/10

  spywarediscoverytrojaninfostealerazorult

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Checks for installed software on the system

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2