General

  • Target

    321c6230b9d1a1082461464b9faf1570_JaffaCakes118

  • Size

    595KB

  • Sample

    240511-b8xc5sef2w

  • MD5

    321c6230b9d1a1082461464b9faf1570

  • SHA1

    c302f07f6c01ab0c6b831865d092afb902ee1e83

  • SHA256

    4d17534f1f36caa88187ffb6d18fada59e60130a03106630c1cf51fd3c302148

  • SHA512

    90897955fc124b9d725b56780ed14d20233283a75ad190558fde41f8c8d7388a7b62ffa24d0018b372ecbf0956df235006d07af9bf83dbb2c8e4e91162485986

  • SSDEEP

    12288:YW9xNbjckK1U5K62bjgJJZ+at9upCAt7VoiRw:tbjrKef2/g4aD87yii

Malware Config

Extracted

Family

azorult

C2

http://doueven.click/gate.php

Targets

    • Target

      321c6230b9d1a1082461464b9faf1570_JaffaCakes118

    • Size

      595KB

    • MD5

      321c6230b9d1a1082461464b9faf1570

    • SHA1

      c302f07f6c01ab0c6b831865d092afb902ee1e83

    • SHA256

      4d17534f1f36caa88187ffb6d18fada59e60130a03106630c1cf51fd3c302148

    • SHA512

      90897955fc124b9d725b56780ed14d20233283a75ad190558fde41f8c8d7388a7b62ffa24d0018b372ecbf0956df235006d07af9bf83dbb2c8e4e91162485986

    • SSDEEP

      12288:YW9xNbjckK1U5K62bjgJJZ+at9upCAt7VoiRw:tbjrKef2/g4aD87yii

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

MITRE ATT&CK Enterprise v15

Tasks