Extracted

• • Target
    9fYI48zaTwSnHR1.exe
  • Size 761KB
  • SHA256 c41a35d1a3de4fd8f2a3138c90ca1453e8935e22ba6ccb1224fe370e0d0848ea
  • MD5 ef09d2442abf0102ea4e9833f034dae5
  • SHA1 a86b3235f7284c8a61f327e1f6bf172dd7d9650b
  • SHA512 eec674279500ed1241b2ff113187c32dcc0ed19ec310941388a6059155e30430f802c1ca643ae5682fdf08e58f9bd7338d03548d83d164fe73cd7e89dd46fda3
  • MD5 SHA1 SHA512

  Score

  10^/10

  azorultdiscoveryinfostealerspywarestealersuricatatrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • suricata: ET MALWARE AZORult Variant.4 Checkin M2

    suricata: ET MALWARE AZORult Variant.4 Checkin M2

    suricata

  • suricata: ET MALWARE AZORult v3.2 Server Response M3

    suricata: ET MALWARE AZORult v3.2 Server Response M3

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M16

    suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M16

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M6

    suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M6

    suricata

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2