Extracted

• • Target
    rSejst206.exe
  • Size 323KB
  • SHA256 bb66c3fabdbf663545fbd44331a0b4c7031ea94082b8a47c4243b1d65cb9d8a4
  • MD5 c7672b430a60c1d2b7bc575909939a45
  • SHA1 f40ebefa7b1d73e05a3fb95712da3f13ed82f732
  • SHA512 ccbfe2070f3a8bb1f39f28f8b639f7c83b85b82a295d23a6b80ffd15d110adbd6089018e55d05980dbc83e506083168e3caefb22025edc5379c2e54680a69b58
  • SSDEEP 6144:R4SUjhth51Ase8i6e7Pf8N5Zz3XIZmLm56zsoI+vL9sEInDph:q/bI8ljAmLG6g+S/9h
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  azorultguloaderdownloaderinfostealerspywarestealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2