Extracted

• • Target

    ba4048bd09b860638952397c4bf83eeb_JaffaCakes118

  • Size

    7.4MB

  • MD5

    ba4048bd09b860638952397c4bf83eeb

  • SHA1

    7d0b68938d8bed360310d4b6a1d90112640b832a

  • SHA256

    dd860b1b9612e733d8f0985148b1f47cd9361243ccb729c3b6c3c2280461e157

  • SHA512

    7666bc99fec316f2d053d39cf64a3ad9dcc7487edfa9926d63b8a0dc89fcdfc1208d3d983c90cf1c83bcaaba86166b1af7c2bb6172941dc10c62965f24338a89

  • SSDEEP

    196608:+jAIMBqN2/6NgE3aIOGW5ueQvD5LHMY8QU4PzETeS:+jMBqNX3leQvFmQU4L0d

  Score

  10^/10

  azorultinfostealertrojandiscovery

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2