Extracted

• • Target
    jaffacakes118_Trojan-Spy.Win32.Stealer.hvp.c4bc8922b29bd635f5023785ed751883
  • Size 408KB
  • SHA256 8817bbe670fd8b951bee2bc7b8a6df828e74a01ad91dd5827b6ca05b75949fcd
  • MD5 c4bc8922b29bd635f5023785ed751883
  • SHA1 827df5b8194d5770d05ce1c2bef136588e184642
  • SHA512 bb314e185ea059f8d3282e58d93fd43405fa8888c7122942856398df416c852e9e09fec4bcb42b0ad61284f288a1937e14405afbfe9008df5e5daaf59b8ad2b7
  • SSDEEP 3072:UM6huHEkxsLBewttzoXcNVgHWSIm7PQcDqHFP1LAnUHwP3JdEgYNAJh3eJ:btsfzoXwg2Nm7PJDqldLAswXsEh3g
  • TLSH
    T11294F155A8ADAD35D19842B1134D3D90AA4A3CB257241D0771ECFAEC2F3CEA19BC325F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryazorultinfostealerpersistencetrojan

  • Family: Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2