General

  • Target

    6416f73d99ca6afb095f941092c0e0c9_JaffaCakes118

  • Size

    812KB

  • Sample

    240521-vpkd1scf51

  • MD5

    6416f73d99ca6afb095f941092c0e0c9

  • SHA1

    e8ad1c3f2a461e01b5d511c633370aaf1d998d57

  • SHA256

    46e5f60278f4ba1e1b4c8ea31bb34d3f3682906fe35bce952d0abf55b3c35d38

  • SHA512

    1d86ecf8f36946680c5caf1f3910d97cc7d5c6d9bb711ad02d5160e0b257deec0f743ebe6f975eae7b7fdcc7eca6d7ea427028440141dfefb74aeb8a184ed213

  • SSDEEP

    12288:bb6mCM9sXHh9BoRPqsxOVKuS5r70xwgeqh043L97/hOBmQr0cZ42:qeSHhYRRxOVGcxJBdb1EIcZl

Malware Config

Extracted

Family

azorult

C2

http://207.154.254.218/index.php

Targets

    • Target

      6416f73d99ca6afb095f941092c0e0c9_JaffaCakes118

    • Size

      812KB

    • MD5

      6416f73d99ca6afb095f941092c0e0c9

    • SHA1

      e8ad1c3f2a461e01b5d511c633370aaf1d998d57

    • SHA256

      46e5f60278f4ba1e1b4c8ea31bb34d3f3682906fe35bce952d0abf55b3c35d38

    • SHA512

      1d86ecf8f36946680c5caf1f3910d97cc7d5c6d9bb711ad02d5160e0b257deec0f743ebe6f975eae7b7fdcc7eca6d7ea427028440141dfefb74aeb8a184ed213

    • SSDEEP

      12288:bb6mCM9sXHh9BoRPqsxOVKuS5r70xwgeqh043L97/hOBmQr0cZ42:qeSHhYRRxOVGcxJBdb1EIcZl

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks