General

  • Target

    492241916d1410755725780bf057b411_JaffaCakes118

  • Size

    618KB

  • Sample

    240516-c43vssgh56

  • MD5

    492241916d1410755725780bf057b411

  • SHA1

    4b39908f479399fd22cc4b0ea79ee941ce887353

  • SHA256

    262f1c4dadec933987054be084175cd9b88774a3d4838c06a6f4a9bf0cb682ab

  • SHA512

    28c5e537527dbbaeb948ec0dc14168dce0d8151fe23a436e84cfdf12f786f2fbe2555d99cc8822b54e152ebda234dd66ae15df3626eda4723c17c5a70ec1cffd

  • SSDEEP

    12288:94a9SL0NbJFUPBzhNo65MIvaTV408/ipnWIL+BAKCVn:94a9MCJKhNo65im05pnWIbKU

Malware Config

Extracted

Family

azorult

C2

http://guccizone.bit/index.php

Targets

    • Target

      492241916d1410755725780bf057b411_JaffaCakes118

    • Size

      618KB

    • MD5

      492241916d1410755725780bf057b411

    • SHA1

      4b39908f479399fd22cc4b0ea79ee941ce887353

    • SHA256

      262f1c4dadec933987054be084175cd9b88774a3d4838c06a6f4a9bf0cb682ab

    • SHA512

      28c5e537527dbbaeb948ec0dc14168dce0d8151fe23a436e84cfdf12f786f2fbe2555d99cc8822b54e152ebda234dd66ae15df3626eda4723c17c5a70ec1cffd

    • SSDEEP

      12288:94a9SL0NbJFUPBzhNo65MIvaTV408/ipnWIL+BAKCVn:94a9MCJKhNo65im05pnWIbKU

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

MITRE ATT&CK Matrix

Tasks