Extracted

• • Target
    6200_921_pdf.vbs
  • Size 3KB
  • SHA256 a9b4cf66af0cef2235b5e50e71ecc7b9b3f0576d33d0666acbfacf48aff810e3
  • MD5 e00efaa883bcaacef6d6b75b289fd067
  • SHA1 bdfbff6bfd9c67c7290e5ed21dfe97d90302b9cb
  • SHA512 b8c57aac388320e2d623373817bf00d8b436a8b0e21e64d8ab88577d6de54ee20b026c2af87b031a574be6de164df4e76f5d6c9733074d1b82860d500f01ab87
  • MD5 SHA1 SHA512

  Score

  10^/10

  azorultcollectioninfostealerspywarestealersuricatatrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • suricata: ET MALWARE AZORult Variant.4 Checkin M2

    suricata: ET MALWARE AZORult Variant.4 Checkin M2

    suricata

  • suricata: ET MALWARE AZORult v3.2 Server Response M3

    suricata: ET MALWARE AZORult v3.2 Server Response M3

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M14

    suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M14

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4

    suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4

    suricata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2