Extracted

• • Target

    24010-KAPSON.exe

  • Size

    927KB

  • MD5

    21c5e6a566f4f22671bd4933ab0dce66

  • SHA1

    764dcbf2aaa25271833bfe217594e07bf4bb9e93

  • SHA256

    1112d16470efe5c9714789944abe3dd43665d9b1f3a206b5d15406e6ab0ef414

  • SHA512

    ae7d18770a9a12077f33c2657b9ea852dbb4cf11f759be0064046c40866ce1f49f20d32737934b75694ee1e55fe479121ee5434d9d35628c3a0a1cdf12a8648b

  • SSDEEP

    24576:juA8Xd6qZNpie53Kl6RJNBIQll+hQT2jiux5J:RKdkec0RFIQlluQsxD

  Score

  10^/10

  discoveryexecutionazorultcollectioncredential_accessinfostealerspywarestealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Azorult family

    azorult

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Blocklisted process makes network request

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/nsExec.dll

  • Size

    6KB

  • MD5

    51e63a9c5d6d230ef1c421b2eccd45dc

  • SHA1

    c499cdad5c613d71ed3f7e93360f1bbc5748c45d

  • SHA256

    cd8496a3802378391ec425dec424a14f5d30e242f192ec4eb022d767f9a2480f

  • SHA512

    c23d713c3c834b3397c2a199490aed28f28d21f5781205c24df5e1e32365985c8a55be58f06979df09222740ffa51f4da764ebc3d912cd0c9d56ab6a33cab522

  • SSDEEP

    96:W7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgN738:Iygp3FcHi0xhYMR8dMqJVgN

  Score

  3^/10

  discovery
  behavioral3behavioral4