Extracted

• • Target

    3732449bb9b9aa4e68888f4f816d1b04_JaffaCakes118

  • Size

    7.5MB

  • MD5

    3732449bb9b9aa4e68888f4f816d1b04

  • SHA1

    1a2a556913a43b9bb729a8c372e33013fa6aff9a

  • SHA256

    2ad7b2fae758e64b4479a2773101f1f408bdc8b970860bc65bc361642a29aeee

  • SHA512

    cdcfcf91e3963251f45f5ffc0831455b203cc4aa485ec5cae35dc0ca08adf526e289e9a8dc50000b1ec58b3d6148e385a96214627a85433a9a118a74e5e5f9ef

  • SSDEEP

    196608:DCKFhIdB4LC4BgRexpA4O1Xq7pZIBVIAg26FsluEMC/WpsvkCesIGu:Ggo4m4iwg/qfDLKEC/WSvkCeH

  Score

  10^/10

  azorultdiscoveryevasioninfostealerpersistencetrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers COM server for autorun

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2