Extracted

• • Target
    a05edb5477d2d7455ea8055a66746c1541eb189d70cd3.exe
  • Size 480KB
  • SHA256 a05edb5477d2d7455ea8055a66746c1541eb189d70cd37a2f9da3d2e2dbb1dc3
  • MD5 badf16b5411ab2ec95f1dd8cdbb02d8e
  • SHA1 6ef714929dbc886613053e6444872793f56059be
  • SHA512 1cfae35ddd7a1695b50a5c08e19c35115d49e15fd6694f9188455a26f334fc6867da8befb15cc6a0c369b096b53950db48e9dd915a38e7151459271756d2ffbb
  • SSDEEP 12288:qZ3IOfnw1bRqbMeeVBJRl31WBuA1/dTpWCw:qZ3IO4tRqbyBJvFWIA11FWCw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  azorultcollectiondiscoveryinfostealerspywarestealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2