General
-
Target
1ad400b10615e0e36044ebdb5392005e_JaffaCakes118
-
Size
405KB
-
Sample
240506-fdf5wscd44
-
MD5
1ad400b10615e0e36044ebdb5392005e
-
SHA1
8a2ddfb40dd1dc1d1a36e804fbba6f75749d63fa
-
SHA256
e8825837bc5c5383a9b1951ff8ed9b885603d44578c5b14f76ba199a79311c58
-
SHA512
1e49af0d369267ddd92e0f0397bb34674262c21dabf218718a17ab14e11a4f5913f47a93b1fb7e2cf2cd57221d14ef8a3eb320a77a730785e7bb1d6e813f4402
-
SSDEEP
12288:CZwuf4/IVsuiLJlmXxV4xh8nnChtQ9nnTfaS:kTqRCXMxh8C7snTfaS
Static task
static1
Behavioral task
behavioral1
Sample
1ad400b10615e0e36044ebdb5392005e_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1ad400b10615e0e36044ebdb5392005e_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
azorult
http://projectkanor.bit/az/index.php
Targets
-
-
Target
1ad400b10615e0e36044ebdb5392005e_JaffaCakes118
-
Size
405KB
-
MD5
1ad400b10615e0e36044ebdb5392005e
-
SHA1
8a2ddfb40dd1dc1d1a36e804fbba6f75749d63fa
-
SHA256
e8825837bc5c5383a9b1951ff8ed9b885603d44578c5b14f76ba199a79311c58
-
SHA512
1e49af0d369267ddd92e0f0397bb34674262c21dabf218718a17ab14e11a4f5913f47a93b1fb7e2cf2cd57221d14ef8a3eb320a77a730785e7bb1d6e813f4402
-
SSDEEP
12288:CZwuf4/IVsuiLJlmXxV4xh8nnChtQ9nnTfaS:kTqRCXMxh8C7snTfaS
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious use of SetThreadContext
-