Extracted

• • Target

    3861227PDF.exe

  • Size

    1.8MB

  • MD5

    25f2e969c52e37a8736b6d88505ea6f8

  • SHA1

    5dd681419c1a523dbe89d3c73bffb116f8610492

  • SHA256

    44ef17967b82842517eb8df06cb26e13f5a9497d86c96efd0413034ceb0f3098

  • SHA512

    1fb08586dca5a202263f8b0ad543cda15f0908d6650bc63941ae152857992b77b272a6540981451946ab823eec503e2f9d65e3d13932c16eb4e470eef0cfd48f

  • SSDEEP

    24576:c9Eo58GkebxHQcximd8311xZP1pG/3MUg1EmNPG4feB1GQc92JU1h:cDkegmC3D1pG/MUoEmNPRDr9v

  Score

  10^/10

  discoveryazorultcollectioncredential_accessinfostealerspywarestealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Azorult family

    azorult

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2