Extracted

• • Target
    Payment Swift Notification_pdf.exe
  • Size 379KB
  • SHA256 1c2894353e85e78ce3f7d55ce6ef7422e5ddcc52dfa1a92bbe6808c01228e57e
  • MD5 b9a1e3f3bc25b19ccc08a0526a28f177
  • SHA1 b8ea778dbe7c855b270be29375d2949650fc2681
  • SHA512 f5d1513d53a8b19d8066a5bdff1903e1a27501f00ae9e1eaabf92bb01f34de8ea2a6bb817a667e47861f25d6ad8fe3a21d440af8c97cbf4b67924267d90d61c9
  • MD5 SHA1 SHA512

  Score

  10^/10

  azorultdiscoveryevasioninfostealerspywaretrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • JavaScript code in executable

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2