Extracted

• • Target

    b1d2c6a081a911db6157479403f6b279_JaffaCakes118

  • Size

    1.9MB

  • MD5

    b1d2c6a081a911db6157479403f6b279

  • SHA1

    63983454fcf3e5c8d4adad7566b1048922819164

  • SHA256

    47c778403ce04173c50f686ad986b977e9e5048f3505fd1922e93c4ddee11727

  • SHA512

    0c7847a5dc144a5a293d57e2aad923adbfcb48afb91374d76d1800b4868863bf18606dfdb9c0453f5d3bc20594b324c8a6f131f5c59416b7c574442b4edf80b3

  • SSDEEP

    24576:+HZQS+B2kOVzDiaEwWWoFxUt0ChpFd0hjxx7Rr10:LgVTWWpt7pFd0DxB10

  Score

  10^/10

  azorultevasioninfostealerpersistencetrojanupx

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Modifies Installed Components in the registry

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2