Resubmissions

11-05-2024 17:57

240511-wjxylaac6s 10

11-05-2024 17:54

240511-whck9sab7y 10

General

  • Target

    35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118

  • Size

    472KB

  • Sample

    240511-whck9sab7y

  • MD5

    35d38360b8f7bfe5ecc9dd3b5c1eabec

  • SHA1

    c0d74936f84101199acf01a9e5951478f2cf91ba

  • SHA256

    accb399db6dbdcadd7022d05a258993119e3abeed04394921ae0aa14b2b468bf

  • SHA512

    2a3a851a4090936a15c9d9cbe391afd82906ff66ec913daeead0d56098429b5ed76e0aa7d6cda845de3130c417681fd09154c4a9c9907237a934f8036aac532b

  • SSDEEP

    6144:YKAGqv0MkNUfrQVSSpn9FXDi57PXF0jB5IX3R7FGb7:YK3qUArQVSUWMB52RpGP

Malware Config

Extracted

Family

azorult

C2

http://docusign.bit/index.php

Targets

    • Target

      35d38360b8f7bfe5ecc9dd3b5c1eabec_JaffaCakes118

    • Size

      472KB

    • MD5

      35d38360b8f7bfe5ecc9dd3b5c1eabec

    • SHA1

      c0d74936f84101199acf01a9e5951478f2cf91ba

    • SHA256

      accb399db6dbdcadd7022d05a258993119e3abeed04394921ae0aa14b2b468bf

    • SHA512

      2a3a851a4090936a15c9d9cbe391afd82906ff66ec913daeead0d56098429b5ed76e0aa7d6cda845de3130c417681fd09154c4a9c9907237a934f8036aac532b

    • SSDEEP

      6144:YKAGqv0MkNUfrQVSSpn9FXDi57PXF0jB5IX3R7FGb7:YK3qUArQVSUWMB52RpGP

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks