Extracted

• • Target
    Request for Quotation - 4RFQ001247.xlsx
  • Size 317KB
  • SHA256 5ecbede7e01f58eefee2ccc3afb54af12096d862c0c9b50b7710e94d7ca4acb5
  • MD5 1393e5703964fd90e491371b51db782a
  • SHA1 bfb507ff1779684c4ea98df967035b7f206b9ffd
  • SHA512 0513b05642e3ced0e8da7a1211310fda0ca5d393c48775a77e2127b99d60f4522ad7920bbdd9b3033ac28032d48a38c84a9e11f7ccd206001943345e20189b20
  • MD5 SHA1 SHA512

  Score

  10^/10

  azorultcollectioninfostealerspywarestealersuricatatrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • suricata: ET MALWARE AZORult v3.3 Server Response M3

    suricata: ET MALWARE AZORult v3.3 Server Response M3

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M5

    suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M5

    suricata

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2