Extracted

• • Target

    0b362f2efee067c3c1c5ed37b5bba52c_JaffaCakes118

  • Size

    7.5MB

  • MD5

    0b362f2efee067c3c1c5ed37b5bba52c

  • SHA1

    142d2532e58e3c2d0a41eb5f36398d964c3c2a35

  • SHA256

    08f1b0d9d19357e225f124b324969afaf84e7da51eeaf5a714b80192236d7191

  • SHA512

    d709e11fa76892f0704fe535058ec674fd9871b1293565cd21708619ae3be9e15d3f0b8394a613c36d1a7add588d42a8968252b40c3fcd624195284229672d0a

  • SSDEEP

    196608:fCKxhIdB4LC4BgRexpA4O1Xq7pZIBVIAg26FsluEMC/WpsvkCesIG:ako4m4iwg/qfDLKEC/WSvkCeH

  Score

  10^/10

  azorultdiscoveryevasioninfostealerpersistencetrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers COM server for autorun

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2