General

  • Target

    2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118

  • Size

    510KB

  • Sample

    240509-rqy21seb4w

  • MD5

    2a61ed646b3bc1ffc6a186936ea38f37

  • SHA1

    cff639c2770fa6fe53095f2c4571088001481bf0

  • SHA256

    6bfa9afe00817e0bb095857b29aa5d9b6cff24a3a00d8f6f2ecdb46044166e6d

  • SHA512

    bfe8d71ebeab8227c3ccc21c567ddb90b1d73dd6834110c496ae70cec410c435689bdea79672d1e874ae4cf7fe0888a6aa35214c0c4f3fd873ec325b046bb61a

  • SSDEEP

    6144:mpVFXXnEkkzFkldxNDEKu0jExGwoMwrni/Y4Yv1MHCR+5K7/J3bVuRpIIQ+:0FnnEkkZkjxluyTFr12To7B3oIIQ+

Malware Config

Extracted

Family

azorult

C2

http://185.79.156.23/jg/6/index.php

Targets

    • Target

      2a61ed646b3bc1ffc6a186936ea38f37_JaffaCakes118

    • Size

      510KB

    • MD5

      2a61ed646b3bc1ffc6a186936ea38f37

    • SHA1

      cff639c2770fa6fe53095f2c4571088001481bf0

    • SHA256

      6bfa9afe00817e0bb095857b29aa5d9b6cff24a3a00d8f6f2ecdb46044166e6d

    • SHA512

      bfe8d71ebeab8227c3ccc21c567ddb90b1d73dd6834110c496ae70cec410c435689bdea79672d1e874ae4cf7fe0888a6aa35214c0c4f3fd873ec325b046bb61a

    • SSDEEP

      6144:mpVFXXnEkkzFkldxNDEKu0jExGwoMwrni/Y4Yv1MHCR+5K7/J3bVuRpIIQ+:0FnnEkkZkjxluyTFr12To7B3oIIQ+

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks