Extracted

• • Target
    CONFIRMATION.exe
  • Size 539KB
  • SHA256 27fdec7935a10e8c7217c0cdfa4a4f4ddc6f32f62df49dc00e104476b5bec065
  • MD5 175fe32bf9c49be859baa991f21dcdcf
  • SHA1 3104ffad96380a74b484f9426a02a0364cc9c3b8
  • SHA512 6f37421ab9e36aa8c81ffccc45f57bd879ff3dd7a2566653f59a6e99708fffbb06616c201881716a5ebe5d32bc69ab1607e9cf34660c9ca6d0845ae46084c13e
  • MD5 SHA1 SHA512

  Score

  10^/10

  azorultdiscoveryinfostealerspywarestealersuricatatrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • suricata: ET MALWARE AZORult v3.2 Server Response M3

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M16

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M2

    suricata

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2