Extracted

• • Target
    2900_291_pdf.vbs
  • Size 3KB
  • SHA256 4e31ec8d34e7b2c7b80eae6a9e956e5e6c71c9119f5babefc8ac77025c96560c
  • MD5 ae92d8b250020bc599cab811d625fab5
  • SHA1 ab7a7ca8e8e3c7e766254f552a94f43dc05301f4
  • SHA512 e7cf40bf9c96b401e2ca7f2ab3dcfe37eb809d4ff7b68e9fba3567ab01ed73f63467f6199026727bd5dc34acaec494c36deab142ffc904ffde62bff10424613c
  • MD5 SHA1 SHA512

  Score

  10^/10

  azorultcollectioninfostealerspywarestealersuricatatrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • suricata: ET MALWARE AZORult Variant.4 Checkin M2

    suricata: ET MALWARE AZORult Variant.4 Checkin M2

    suricata

  • suricata: ET MALWARE AZORult v3.2 Server Response M3

    suricata: ET MALWARE AZORult v3.2 Server Response M3

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M13

    suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M13

    suricata

  • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M5

    suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M5

    suricata

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2