Extracted

• • Target

    NEAS.045848ae3096362920d4a701b216bd30_JC.exe

  • Size

    720KB

  • MD5

    045848ae3096362920d4a701b216bd30

  • SHA1

    955b04eba6c60c3573e3c557c9725cfdb5c23dce

  • SHA256

    4661ac1cd1649de19baa27c5434965705b97b3f6d57e4c72b6db703749fa6c40

  • SHA512

    809a73dd36cdf436ec0bf02a388b63d86e890f5665ad0f9f37a6e82aa90b052732685a38ee07f681361e9a7d8942b9e3be029cf9edb8ba4a446290171cf2e894

  • SSDEEP

    12288:DquErHF6xC9D6DmR1J98w4oknqOKw/zTd1RVaHvymUi6rjXrm62iU952aLovi754:arl6kD68JmloO7TdNaPymUi63i62xHLE

  Score

  10^/10

  azorultinfostealertrojanupx

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2