Extracted

Extracted

• • Target
    59e2c9c861cfd0e2114f51d9db476476.exe
  • Size 1008KB
  • SHA256 42caa5a2e19134770914b3b33dffaceaae03a44fc52babd8abc250d7d7696945
  • MD5 59e2c9c861cfd0e2114f51d9db476476
  • SHA1 307e889a3d28e50c959e94923197dda40d56b000
  • SHA512 700bc0b37e0e1d99d6bc3ee3ee66d8fd2213bbc21f3a58cb07dd9d1a425cbc49cb104500f87868077a52c40bf4ec291a6ea66c1022a159e1ac189c6aa3474ade
  • MD5 SHA1 SHA512

  Score

  10^/10

  azorultoskidiscoveryinfostealerspywarestealersuricatatrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M18

    suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M18

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M2

    suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M2

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2