Extracted

• • Target

    18a46b8b73342b585ea81589e7a8fbfd874c6b80fce4fb0538ffd0c8e4fdac5bN

  • Size

    515KB

  • MD5

    9641fcc015ebd704313a59d7e2382830

  • SHA1

    d120c73b61d874a0d18619db9cd2ebcae1f96742

  • SHA256

    18a46b8b73342b585ea81589e7a8fbfd874c6b80fce4fb0538ffd0c8e4fdac5b

  • SHA512

    129238a107592e2c03733d09e89ee4d331dd33da1d766015c926a1919e78447e326ae6e66c9adae83637a66b748def2296bbd61704cf6d3c4734c25447bb8798

  • SSDEEP

    6144:EZ/qRrwS4RI/JeAabqOYA79/KhkpKpKSfAuSpllC1CYKQ4ouOO/wCi1p4:EBlDRuJeAROx/pKpxfATjSuOCC4

  Score

  10^/10

  azorultguloadercollectioncredential_accessdiscoverydownloaderexecutioninfostealerspywarestealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2