Extracted

• • Target

    17272470060fdebf9e12583ea0a47454a5f4291fca9ce6e452d2026b517845d5a14a463387483.dat-decoded.exe

  • Size

    112KB

  • MD5

    fc7ff7397010d34501d9a0a725637c1a

  • SHA1

    213c77163e360a38ee0090fef436592d2527711b

  • SHA256

    8ab4dc8b9dd4ef04daf96283fb32fda0c23875c4af532186376057894a9c2c39

  • SHA512

    b895012ab2b91a9f6a25e4ba50f8568bc7b976a851abe94c9fc2b60269ff837c09a1fffd61ab13698cac81492e38d3655e0b7a63b1bbf18203f1748389d5b8f4

  • SSDEEP

    3072:KExRaQ6raoCoCyz6/mqv1JR+yBtGOeaeWgiQq:faO1tme++wi/

  Score

  10^/10

  azorultcollectioncredential_accessdiscoveryinfostealerspywarestealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2