Extracted

• • Target
    Urgency order_2022-00460198.xlsx
  • Size 77KB
  • SHA256 4c719222a03114cbbf82a6f633cc7bd088dcb1010f88e35ee0f9402aaf662100
  • MD5 5f90916b70ab8732cb5c3b0dbdece7b6
  • SHA1 5fb01772fbf85a6b183686b0224c035d24c33c63
  • SHA512 92221c49ca4659869995ec8736e0a12c62c29759c95c944dfb2da15e3f5e969dba83c71991b628c4b049221af09083a84086d6ece240ded4853c0850e520129d
  • MD5 SHA1 SHA512

  Score

  10^/10

  azorultmodiloadercollectioninfostealerpersistencespywarestealersuricatatrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • suricata: ET MALWARE AZORult v3.3 Server Response M2

    suricata: ET MALWARE AZORult v3.3 Server Response M2

    suricata

  • suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request

    suricata: ET MALWARE MSIL/GenKryptik.FQRH Download Request

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M4

    suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M4

    suricata

  • ModiLoader Second Stage

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence
  behavioral1behavioral2