General

  • Target

    45a976181284b3419e55320b93994da9_JaffaCakes118

  • Size

    692KB

  • Sample

    240515-l3wjrsce23

  • MD5

    45a976181284b3419e55320b93994da9

  • SHA1

    b72634b5d162e331925535285eb6e5b541842506

  • SHA256

    8403fcac5753889bca8e6df68f5401d79e817927835442163741b25ece9db2bb

  • SHA512

    661444d5c398c00f27afb0469cd8844b42b3d0126d3187955bfabebfe50d6b0be2525587f6c059c54bc81a594540221e654b2f0a88833182aa8a0ca8baea9b39

  • SSDEEP

    12288:nIz8TpSPVV+RmDzFL2AB47uggFa24TLoI2qQ4SDY:vToPV+OFBmuNay9DY

Malware Config

Extracted

Family

azorult

C2

http://185.195.236.168/1gw3/index.php

Targets

    • Target

      45a976181284b3419e55320b93994da9_JaffaCakes118

    • Size

      692KB

    • MD5

      45a976181284b3419e55320b93994da9

    • SHA1

      b72634b5d162e331925535285eb6e5b541842506

    • SHA256

      8403fcac5753889bca8e6df68f5401d79e817927835442163741b25ece9db2bb

    • SHA512

      661444d5c398c00f27afb0469cd8844b42b3d0126d3187955bfabebfe50d6b0be2525587f6c059c54bc81a594540221e654b2f0a88833182aa8a0ca8baea9b39

    • SSDEEP

      12288:nIz8TpSPVV+RmDzFL2AB47uggFa24TLoI2qQ4SDY:vToPV+OFBmuNay9DY

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks