Extracted

• • Target

    55e729acd924b9b12aa0aae143ab10cd09aa16be3579b7bb7c1050d1cb84a79c

  • Size

    4.9MB

  • MD5

    0b231d087bca950f9bd6d8671df8dfa8

  • SHA1

    cbe191e1d354b7e4fd174d0ee22676937270c8ba

  • SHA256

    55e729acd924b9b12aa0aae143ab10cd09aa16be3579b7bb7c1050d1cb84a79c

  • SHA512

    0bc46fb8f35077d5e532a99fad44af4929407b5b33b2325897dc67a469394b8246d24e9c8d4550fd64f8e9e4bf5d87dc0aa78cb104e95b8786b6bfebd3ccf696

  Score

  10^/10

  azorultkpotdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

    trojanstealerkpot

  • KPOT Core Executable

  • Modifies system executable filetype association

    persistence

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Registers COM server for autorun

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2