General
- Target 59b83a0e37ac6e046cf013616d51dff99d06d0bbbcc02b585c9cd1d1fa7e952d.vbs
- Size 26KB
- Sample240308-cnvt9acf72
- SHA256 59b83a0e37ac6e046cf013616d51dff99d06d0bbbcc02b585c9cd1d1fa7e952d
Score
10/10
Malware Config
Targets
-
- Target 59b83a0e37ac6e046cf013616d51dff99d06d0bbbcc02b585c9cd1d1fa7e952d.vbs
- Size 26KB
- SHA256 59b83a0e37ac6e046cf013616d51dff99d06d0bbbcc02b585c9cd1d1fa7e952d
Score10/10Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
Blocklisted process makes network request
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Loads dropped DLL
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Legitimate hosting services abused for malware hosting/C2
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext