Extracted

• • Target

    Req for Quote.exe

  • Size

    1.1MB

  • MD5

    3edf540c2cac6f08dd893c30ee05e392

  • SHA1

    ebe6d5f431e029976d6a63e752d78a2ade56a737

  • SHA256

    a7167a16b72e8a302fd2861103595f01d20f1440d98945fadbbd0dca0425e089

  • SHA512

    05e6b9ffb1d25673ba9c6cdbf5f3b69a6bb9c6fac2618a5bd0be9aa4fd365f273f73384c60afffe0eaeeb083c1df95d5adc737f6f3174762bf4bef320f036ad8

  Score

  10^/10

  azorultdiscoveryinfostealerspywarestealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2