Extracted

• • Target

    Purchase order_ invoice confirmation.exe

  • Size

    625KB

  • MD5

    888b78f962190563e7697b616f873764

  • SHA1

    ee24327900875f0d35b2e11144d36e4ee1a91fdc

  • SHA256

    0e2ba1030dfacd7a4a43a79fde62312c2ce9bd18b0c37207099fc7271b99a1d8

  • SHA512

    3b91672b2ea54e6fd72e568879daebb2b7192a3598614fae009f452a03ebaf9b8d08ede76a69133af0bfdd8e7d0ee7b18d988965d1063846f9253ba4902420bd

  • SSDEEP

    12288:4kiCPnAdfah9q6RNxBQBcmBbiZbIvlZx:4ifAdfah9qgBQcwiUf

  Score

  10^/10

  azorultdiscoveryinfostealerpersistencetrojancollectioncredential_accessspywarestealer

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Azorult family

    azorult

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2