Extracted

• • Target
    Image051.lnk
  • Size 2KB
  • SHA256 db17966433630a4e75bb1a4e9aa3ebe3b9fb88e6a4fbd32b6ab4564e0af44466
  • MD5 e0b38fd090a7203b08317fb27b923cca
  • SHA1 daf0137ffeba8d635ebf2dfe852990d667c0f7ba
  • SHA512 4df60384a4a4f3d70b6a8fd285ea4637ef791efd318383589d7b44d2838d6c0446391058ee6b4dc439fa4889fee8fa726a5234ba3e1177cd9f7eeb95f171983c
  • MD5 SHA1 SHA512

  Score

  10^/10

  azorultcollectiondiscoveryinfostealerspywarestealersuricatatrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • suricata: ET MALWARE AZORult Variant.4 Checkin M2

    suricata: ET MALWARE AZORult Variant.4 Checkin M2

    suricata

  • suricata: ET MALWARE AZORult v3.2 Server Response M3

    suricata: ET MALWARE AZORult v3.2 Server Response M3

    suricata

  • suricata: ET MALWARE Possible MalDoc Payload Download Nov 11 2014

    suricata: ET MALWARE Possible MalDoc Payload Download Nov 11 2014

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M16

    suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M16

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2