General

  • Target

    1d5b33f1d5cccc14f9ef33b90d5342a1_JaffaCakes118

  • Size

    1.4MB

  • Sample

    240506-tvf34shh6t

  • MD5

    1d5b33f1d5cccc14f9ef33b90d5342a1

  • SHA1

    931e200a33e7b594ed212d2d4a0d158f8f5821cb

  • SHA256

    c95cb0602ad0c85415767b1ba946bcc4fcdeaa9afc12a86fa6e8336f01dee4af

  • SHA512

    94e8a6d541c74ac134a59866f15ce7b43f732a3c022cdc5541cf2113c41f09d4e644a8dd8c0bffd4de27d8d4fa0d0f82303d45c57c5512d304c0cb966a13bb67

  • SSDEEP

    24576:Eu6J33O0c+JY5UZ+XC0kGso6FaPq3vk62HDLdFFIbndbRdWY:+u0c++OCvkGs9FahFFIbndKY

Malware Config

Extracted

Family

azorult

C2

http://185.195.236.162/x/index.php

Targets

    • Target

      1d5b33f1d5cccc14f9ef33b90d5342a1_JaffaCakes118

    • Size

      1.4MB

    • MD5

      1d5b33f1d5cccc14f9ef33b90d5342a1

    • SHA1

      931e200a33e7b594ed212d2d4a0d158f8f5821cb

    • SHA256

      c95cb0602ad0c85415767b1ba946bcc4fcdeaa9afc12a86fa6e8336f01dee4af

    • SHA512

      94e8a6d541c74ac134a59866f15ce7b43f732a3c022cdc5541cf2113c41f09d4e644a8dd8c0bffd4de27d8d4fa0d0f82303d45c57c5512d304c0cb966a13bb67

    • SSDEEP

      24576:Eu6J33O0c+JY5UZ+XC0kGso6FaPq3vk62HDLdFFIbndbRdWY:+u0c++OCvkGs9FahFFIbndKY

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks