Extracted

• • Target

    bf62a30869d83aa1e2faf63216c0c7b8_JaffaCakes118

  • Size

    3.7MB

  • MD5

    bf62a30869d83aa1e2faf63216c0c7b8

  • SHA1

    bd156db9b03b99d3dc54f8ea2c7ea00286490f55

  • SHA256

    e0746b90daaf74152abd20d620e682beb84ae45bbc456a9023ee5c6d8c1dc08b

  • SHA512

    ec9d8a3b01182e1a19179c16c2f4b6b8672bad967451c6e606eb0fd7a0ef958c13ee9f2013c860b5256809abd1fe67bea0ca42d77e617bace9879d3d2a832827

  • SSDEEP

    98304:uAYRWJ3guzrI7fiL9tgZZEkpDwyPVg1b3QOQYRitH0RSXJgGCnUMW8BMHDWXu:uPWLr3gzNPPVg1brJRitJ5gHD7m9

  Score

  10^/10

  azorultdiscoveryinfostealertrojanupx

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Azorult family

    azorult

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2