General
-
Target
1d5b33f1d5cccc14f9ef33b90d5342a1_JaffaCakes118
-
Size
1.4MB
-
Sample
240506-tvf34shh6t
-
MD5
1d5b33f1d5cccc14f9ef33b90d5342a1
-
SHA1
931e200a33e7b594ed212d2d4a0d158f8f5821cb
-
SHA256
c95cb0602ad0c85415767b1ba946bcc4fcdeaa9afc12a86fa6e8336f01dee4af
-
SHA512
94e8a6d541c74ac134a59866f15ce7b43f732a3c022cdc5541cf2113c41f09d4e644a8dd8c0bffd4de27d8d4fa0d0f82303d45c57c5512d304c0cb966a13bb67
-
SSDEEP
24576:Eu6J33O0c+JY5UZ+XC0kGso6FaPq3vk62HDLdFFIbndbRdWY:+u0c++OCvkGs9FahFFIbndKY
Static task
static1
Behavioral task
behavioral1
Sample
1d5b33f1d5cccc14f9ef33b90d5342a1_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1d5b33f1d5cccc14f9ef33b90d5342a1_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
azorult
http://185.195.236.162/x/index.php
Targets
-
-
Target
1d5b33f1d5cccc14f9ef33b90d5342a1_JaffaCakes118
-
Size
1.4MB
-
MD5
1d5b33f1d5cccc14f9ef33b90d5342a1
-
SHA1
931e200a33e7b594ed212d2d4a0d158f8f5821cb
-
SHA256
c95cb0602ad0c85415767b1ba946bcc4fcdeaa9afc12a86fa6e8336f01dee4af
-
SHA512
94e8a6d541c74ac134a59866f15ce7b43f732a3c022cdc5541cf2113c41f09d4e644a8dd8c0bffd4de27d8d4fa0d0f82303d45c57c5512d304c0cb966a13bb67
-
SSDEEP
24576:Eu6J33O0c+JY5UZ+XC0kGso6FaPq3vk62HDLdFFIbndbRdWY:+u0c++OCvkGs9FahFFIbndKY
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-