Extracted

• • Target

    Dekont#17.07.2023.exe

  • Size

    154KB

  • MD5

    571ee58005b14af0965178929079625b

  • SHA1

    c8df9921cfa7fde32269c058f1361c4f5f117935

  • SHA256

    7501179eedf19e9b094ed763b880f4673998ecef6d8b4732985d04ee0ef1ea1e

  • SHA512

    3f884a0d24e505fddd38d78363aff5f30ced6a29265a1e8342a301a3a56a7f7bf5646e2304212f5c9a9e6e3cf44df82314d1a4ac9d3b72a8782b23c62364d279

  • SSDEEP

    3072:+NzPHk9MpcQbhvCa7XgwLrn0f3Inmq0vd8LI2eTTn99Gddwkqu8DfHrCj:+hRFhvt7XvLrna3Movd6eTCDzqRvrCj

  Score

  10^/10

  azorultguloaderdiscoverydownloaderinfostealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2