Extracted

• • Target

    587e231c6a4a4bf9ea82922c0c192b74.exe

  • Size

    301KB

  • MD5

    587e231c6a4a4bf9ea82922c0c192b74

  • SHA1

    e3e6f420982a2d9f1d405c3513ec8bc0bd558c31

  • SHA256

    57e05a724d94d11f638293113f450fa35ae362e13e1fcedcfe40b50d22500f63

  • SHA512

    84d8982f0702deb0a29c14df9295b098fb2dc053e7235639c0bf143cf2fbf05c6f48efb3eb7d2cd92bc70e9517a160344b5aaad262e83e05aa137cc0dfec20c2

  • SSDEEP

    6144:Dnx13Ii2ou/BNTp1NAC4a0Uuj/80Gp/jTNlhZ/bvLuUj4O4Dqmw:jI7JN91+HUc/wRjZlhViqseH

  Score

  10^/10

  azorultcollectiondiscoveryinfostealerspywarestealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2