Extracted

• • Target
    5918b91ac2931af0267e4af06f3fd2e2.exe
  • Size 100KB
  • SHA256 41acb7b14d4167374da9039e1324caac71b397bf246abb50cb9ae1ca197b3cc1
  • MD5 5918b91ac2931af0267e4af06f3fd2e2
  • SHA1 1ce7cccf52a0a569d013c0a91efb4f808c3c6194
  • SHA512 85c24f4447886373f5522a2cc1b10b74d7f6ae15bebc27137ab07ec8ad0d075074dd662a09714acae57b8b03055b8cfc991bb6a235fb92c65e3a9b92577a710d
  • MD5 SHA1 SHA512

  Score

  10^/10

  azorultguloadercollectiondiscoverydownloaderinfostealerspywarestealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Deletes itself

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2