Extracted

• • Target
    Document.exe
  • Size 327KB
  • SHA256 eeeb1bc5faafbb0921895d6b2bba4d0dce0ef5288e4b22e3eb6ec329b3ef7c6a
  • MD5 abaf5ea47776f6b5c0e1e2b1f15e323e
  • SHA1 46bb1d92fe0ba61008c5a6a660c3df5e0fd95dca
  • SHA512 8a62cdacf3fec7ef10925818d01464913f2bbac6a3216a5d56d289c2891f65e4d19e4e04f37f85ecc959a0628c6dcb2b218a2c9e926061b68b7e1a1a8eb530e3
  • SSDEEP 6144:R4SUjhth5eidq9iTzzy2/TsZFIYDh0EZmLm56zsoI+vL9sEInDpy:q/eiEMXzyCTsXIuasmLG6g+S/9y
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  guloaderdownloaderazorultcollectiondiscoveryinfostealerspywarestealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2