Extracted

• • Target
    MACHINE QUOTAION071122.exe
  • Size 64KB
  • SHA256 38a38cd4d2b2ecef6cdaf804f4569647a5526011e29f233b0326cd0f06f30916
  • MD5 8f6bcccfa18eba6cdbeb716ce795ea83
  • SHA1 e3f8f390edf308a460130b4fd5436e0cb5b20811
  • SHA512 cafea25476544622db8473bc4e7424933a73e5462f6addc5a15ba0d5ada013529559b848e6849e9db4a66b50203fea4d276eb5e6909a0838ec275ee0f21843c9
  • MD5 SHA1 SHA512

  Score

  10^/10

  azorultcollectioninfostealerspywarestealersuricatatrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • suricata: ET MALWARE AZORult v3.3 Server Response M2

    suricata: ET MALWARE AZORult v3.3 Server Response M2

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15

    suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15

    suricata

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2