General

  • Target

    1ad400b10615e0e36044ebdb5392005e_JaffaCakes118

  • Size

    405KB

  • Sample

    240506-fdf5wscd44

  • MD5

    1ad400b10615e0e36044ebdb5392005e

  • SHA1

    8a2ddfb40dd1dc1d1a36e804fbba6f75749d63fa

  • SHA256

    e8825837bc5c5383a9b1951ff8ed9b885603d44578c5b14f76ba199a79311c58

  • SHA512

    1e49af0d369267ddd92e0f0397bb34674262c21dabf218718a17ab14e11a4f5913f47a93b1fb7e2cf2cd57221d14ef8a3eb320a77a730785e7bb1d6e813f4402

  • SSDEEP

    12288:CZwuf4/IVsuiLJlmXxV4xh8nnChtQ9nnTfaS:kTqRCXMxh8C7snTfaS

Malware Config

Extracted

Family

azorult

C2

http://projectkanor.bit/az/index.php

Targets

    • Target

      1ad400b10615e0e36044ebdb5392005e_JaffaCakes118

    • Size

      405KB

    • MD5

      1ad400b10615e0e36044ebdb5392005e

    • SHA1

      8a2ddfb40dd1dc1d1a36e804fbba6f75749d63fa

    • SHA256

      e8825837bc5c5383a9b1951ff8ed9b885603d44578c5b14f76ba199a79311c58

    • SHA512

      1e49af0d369267ddd92e0f0397bb34674262c21dabf218718a17ab14e11a4f5913f47a93b1fb7e2cf2cd57221d14ef8a3eb320a77a730785e7bb1d6e813f4402

    • SSDEEP

      12288:CZwuf4/IVsuiLJlmXxV4xh8nnChtQ9nnTfaS:kTqRCXMxh8C7snTfaS

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks