General

  • Target

    12ef629e17e5374cdf8947717ce46634_JaffaCakes118

  • Size

    521KB

  • Sample

    240504-qpvgrsab32

  • MD5

    12ef629e17e5374cdf8947717ce46634

  • SHA1

    6c230f4797366af5ec794cab87e883b6679b55a7

  • SHA256

    0fa40fd927ec6928a9f9b246dd2b58266875f33cc7dc6eb7bfdad412f96b1c6a

  • SHA512

    18fb2df4b12e4f47a7b4e3ed4c65884c7d58ea0ccc0befcd97f42aa669ebb51592e6654cd6e0318203d4a836f91ab25d6243c645edfe3a95429d1288afb7ad53

  • SSDEEP

    3072:SzbewBG1ytoE+9O4Lp8RkPgsdkvU4mXhZSP8Npe6NkkgC1kzpiRpJ:CohE2LuRkxHXvi8negkkEViR

Malware Config

Extracted

Family

azorult

C2

http://fresfolkrules.ga/deepwater/32/index.php

Targets

    • Target

      12ef629e17e5374cdf8947717ce46634_JaffaCakes118

    • Size

      521KB

    • MD5

      12ef629e17e5374cdf8947717ce46634

    • SHA1

      6c230f4797366af5ec794cab87e883b6679b55a7

    • SHA256

      0fa40fd927ec6928a9f9b246dd2b58266875f33cc7dc6eb7bfdad412f96b1c6a

    • SHA512

      18fb2df4b12e4f47a7b4e3ed4c65884c7d58ea0ccc0befcd97f42aa669ebb51592e6654cd6e0318203d4a836f91ab25d6243c645edfe3a95429d1288afb7ad53

    • SSDEEP

      3072:SzbewBG1ytoE+9O4Lp8RkPgsdkvU4mXhZSP8Npe6NkkgC1kzpiRpJ:CohE2LuRkxHXvi8negkkEViR

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks