Extracted

Extracted

• • Target

    orden_21002_pdf.vbs

  • Size

    104KB

  • MD5

    4c23f122b79aea1ddc7f3fad57be19bc

  • SHA1

    ffe08516f78803c82fe5f99b75aefd0488158957

  • SHA256

    b4233a5f58161b20d27b87ec17701492601ba4d932513c9d22eb8f8b5ac34b76

  • SHA512

    cf479b9ab1369ff85ba1026270042679b8ad7db577d1d01e037e4de01f7c6fb13a2d2497586f3ac63a8267d9dbebe6bb61900ba4fb09ff14001dd6ddb21ed47b

  • SSDEEP

    3072:4M1vA5gZASC5xVeqlGHGw5fCm0eYW/G4xzZoXyxdKpXRR:4evvZkp90NoCvKJRR

  Score

  10^/10

  azorultguloaderdownloaderinfostealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Blocklisted process makes network request

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2