Extracted

• • Target

    NEAS.c88d7ed98df7f50e3eac128a95e20760.exe

  • Size

    720KB

  • MD5

    c88d7ed98df7f50e3eac128a95e20760

  • SHA1

    98679200aea6aaa03f7ed83be7dec8e3824c1206

  • SHA256

    04a768a74b11a2765624d8da9ddecfad30de8441f777b1a55d8744776940582b

  • SHA512

    424da33530f3f700fb1f9ec848d6bc6f651d25effbf97e8acddc451f79ea92d7d6b7678b4356f0e40840f10eedf81794b5e11b00b8fb10cd2cc401f86884f077

  • SSDEEP

    12288:DquErHF6xC9D6DmR1J98w4oknqOKw/zTd1RVaHvymUi6rjXrm62iU952aLovi756:arl6kD68JmloO7TdNaPymUi63i62xHLm

  Score

  10^/10

  azorultinfostealertrojanupx

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2