Extracted

Extracted

• • Target

    3c720177c1225723c87f8826a0827a9f7ed9cc7f825dae843f657eab5470a566.exe

  • Size

    2.0MB

  • MD5

    6845e591eb8e4ae6ed050f660f8b033d

  • SHA1

    ee37cea5a67e37fb093defc2de51b25a02ad3e65

  • SHA256

    3c720177c1225723c87f8826a0827a9f7ed9cc7f825dae843f657eab5470a566

  • SHA512

    25eab1af5ea0b10a0e793618b7d00c863087ecb9cf6fd7673eba12511c4dc942c6c49e6d4c44940220ba9a30cceb6752d68db5bc8ac581a7c55ca84a3579e231

  • SSDEEP

    24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYv:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Y1

  Score

  10^/10

  azorultquasarebayprofilesdiscoveryinfostealerspywaretrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Azorult family

    azorult

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2