Extracted

Extracted

Extracted

• • Target

    e553b05dd2afafadb6ad38d3463056e50cfa31ba3ac5489a7a114ec35ef10194

  • Size

    677KB

  • MD5

    2289a3364018987b2db23e285ae18eb1

  • SHA1

    543520be45c9f0498128422537b7f0adfec5cfb2

  • SHA256

    e553b05dd2afafadb6ad38d3463056e50cfa31ba3ac5489a7a114ec35ef10194

  • SHA512

    5d55201c71aedea5989d320f9d452643989211d0be1835319925f7cffc290d77629a79ea87747b139bc5707617eaefa05872f36abe44f26d4a58476fad06d29e

  • SSDEEP

    12288:EHnuifS057xUtABQxj3kS+tfdF9+fBC/yACGanby0m2gNiyEbFS1ndkkx4WCK7gy:QuifS05FwABQxj3kS+tfdF9+fBC/yACa

  Score

  10^/10

  azorultraccoonremcos081720221f95cf62df71eb84e6a269f19941ccbcdiscoveryinfostealerpersistenceratspywarestealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1