Extracted

• • Target
    6917926pdf.vbs
  • Size 2KB
  • SHA256 d35d564e13ff46a6d1bf48bb7890b2c25586b0201f955847ee314ef8996e54a8
  • MD5 dc442cd9fca1a3be7a89cf8321b575a6
  • SHA1 223755d47f77480e3f1d23b417a7d50a7d4e03ba
  • SHA512 b0e8e8722c9e34616343000697172997fa215e583697a673786a39034392e13389ab5a328f6c6f122a203738437feb067433b18fa87bad26587b53377f28f99c
  • MD5 SHA1 SHA512

  Score

  10^/10

  azorultcollectioninfostealerspywarestealersuricatatrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • suricata: ET MALWARE AZORult v3.2 Server Response M3

    suricata: ET MALWARE AZORult v3.2 Server Response M3

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M14

    suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M14

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4

    suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4

    suricata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2