Extracted

• • Target

    75bf3bb6bbfcecacec371c5c954dd5b0_JaffaCakes118

  • Size

    7.5MB

  • MD5

    75bf3bb6bbfcecacec371c5c954dd5b0

  • SHA1

    f6ad6bd9fabb5036b58a52d64eaf71e7c6b2d30d

  • SHA256

    958a147413f8ef9831b35ac364ca6f52b722848873701a7e9354584806d5b870

  • SHA512

    a2d517882ba4875f501a5dc8ee0e6fe116c8c77b9fecd697cee6271d226ae214146630ba187c66fcfdf2f5563645e0f4d971b9fb8e2efa3bf5a0d4db4ec2a15d

  • SSDEEP

    196608:cCK6hIdB4LC4BgRexpA4O1Xq7pZIBVIAg26FsluEMC/WpsvkCesIGe:XTo4m4iwg/qfDLKEC/WSvkCeHF

  Score

  10^/10

  azorultdiscoveryevasioninfostealerpersistencetrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers COM server for autorun

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2