Extracted

• • Target
    IMG_626166155117636637099388377365355343431DT.exe
  • Size 599KB
  • SHA256 84c63913782658c1a3fe4c7c7f7bb9c2e09591ece6b7018ec3d48c7282582068
  • MD5 b58750b262ee79c332c554bc004702b2
  • SHA1 7f4a16ea0c530b6cb136efb2027632b624ca013d
  • SHA512 efb1ff89773ca35a5bfc9bf7472e7e8495870eec97905e2a17220a5e2b58371ff86ef77ed5f37f32d752fe4c679c1c3b03e79d62963e8906749db01a0b28f2ad
  • MD5 SHA1 SHA512

  Score

  10^/10

  azorultevasioninfostealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2