General

  • Target

    4e4eba5103a1b0bf56c4d1361ac9cdf7_JaffaCakes118

  • Size

    845KB

  • Sample

    240517-eejfzaga9w

  • MD5

    4e4eba5103a1b0bf56c4d1361ac9cdf7

  • SHA1

    fb4265e06b2f9d55c7b3a42621308383896f0eb5

  • SHA256

    f597ff18004f193f7057b9ea45177454fb069d054ca52ba9aa2f555fbd75eddc

  • SHA512

    1a540a5d58e10274a241188b99e1e096beb5e21e6b6aa7f65f885420f3a752be1f6218991c2f648709699b704959403d3e2e9ee48e47e737ce61d2b673f4f323

  • SSDEEP

    12288:Bi543scZgAJP7g5goVhMl0ndjPVCF1e19EUsiOwvH+aoNSFApfTu6WcCe5yINtoM:Bi5hy7gioVbjYHK6JxaoYFAARcxD7+mD

Malware Config

Extracted

Family

azorult

C2

http://jatkit.ga/x0/index.php

Targets

    • Target

      4e4eba5103a1b0bf56c4d1361ac9cdf7_JaffaCakes118

    • Size

      845KB

    • MD5

      4e4eba5103a1b0bf56c4d1361ac9cdf7

    • SHA1

      fb4265e06b2f9d55c7b3a42621308383896f0eb5

    • SHA256

      f597ff18004f193f7057b9ea45177454fb069d054ca52ba9aa2f555fbd75eddc

    • SHA512

      1a540a5d58e10274a241188b99e1e096beb5e21e6b6aa7f65f885420f3a752be1f6218991c2f648709699b704959403d3e2e9ee48e47e737ce61d2b673f4f323

    • SSDEEP

      12288:Bi543scZgAJP7g5goVhMl0ndjPVCF1e19EUsiOwvH+aoNSFApfTu6WcCe5yINtoM:Bi5hy7gioVbjYHK6JxaoYFAARcxD7+mD

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks