General

  • Target

    2ba5aff736713acd479ee6a7706f34e5_JaffaCakes118

  • Size

    845KB

  • Sample

    240509-zm9ncaea5z

  • MD5

    2ba5aff736713acd479ee6a7706f34e5

  • SHA1

    358b88308db6f71961faea61c9b3c995897ca839

  • SHA256

    90959ae72468c4b656f4cac46202eb6629c4288e438f6c0733afa9bead4639ed

  • SHA512

    165966d49c3c67aa4b4ae83d079c324ba6225f880a2de4905dfbe886df134590b7ad089a540b9a0ea68db3343e04de0b7b8c528cbb074ebf44c977f49aa160d4

  • SSDEEP

    12288:hi543scZgAJP7g5goVhMl0ndjPVCF1e19EUsiOwvH+aoC+/Donj29dnLVPp:hi5hy7gioVbjYHK6Jxao5oCLn

Malware Config

Extracted

Family

azorult

C2

http://104.233.105.159/0/aa-00/index.php

Targets

    • Target

      2ba5aff736713acd479ee6a7706f34e5_JaffaCakes118

    • Size

      845KB

    • MD5

      2ba5aff736713acd479ee6a7706f34e5

    • SHA1

      358b88308db6f71961faea61c9b3c995897ca839

    • SHA256

      90959ae72468c4b656f4cac46202eb6629c4288e438f6c0733afa9bead4639ed

    • SHA512

      165966d49c3c67aa4b4ae83d079c324ba6225f880a2de4905dfbe886df134590b7ad089a540b9a0ea68db3343e04de0b7b8c528cbb074ebf44c977f49aa160d4

    • SSDEEP

      12288:hi543scZgAJP7g5goVhMl0ndjPVCF1e19EUsiOwvH+aoC+/Donj29dnLVPp:hi5hy7gioVbjYHK6Jxao5oCLn

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks