General

  • Target

    64679e65c0e04ebb44765a3761884644_JaffaCakes118

  • Size

    407KB

  • Sample

    240521-xn1eysfa43

  • MD5

    64679e65c0e04ebb44765a3761884644

  • SHA1

    eb587ead2bea6dd27dd31f2fe884bcddb24d4277

  • SHA256

    3bdbd65cfc219275bee9e9b4f3100966ae385efe1a433bbb1c00ef305034692e

  • SHA512

    a84f089e1f26d78e8a831588d4388f1af44cbf4fa741840187f438f66dde840a66f8c80e6ecd9c0869cf186233e5b0e2b9623022f100867c891ad513fba34a6b

  • SSDEEP

    6144:YGeJ7zuOrSyJ0tpaP8DSdBbUpof2YAxvWKg6jlH3Hu51:YVrSyJ0tp+b/Qpof2YAWqg1

Malware Config

Extracted

Family

azorult

C2

https://medireab.ga/abs/index.php

Targets

    • Target

      64679e65c0e04ebb44765a3761884644_JaffaCakes118

    • Size

      407KB

    • MD5

      64679e65c0e04ebb44765a3761884644

    • SHA1

      eb587ead2bea6dd27dd31f2fe884bcddb24d4277

    • SHA256

      3bdbd65cfc219275bee9e9b4f3100966ae385efe1a433bbb1c00ef305034692e

    • SHA512

      a84f089e1f26d78e8a831588d4388f1af44cbf4fa741840187f438f66dde840a66f8c80e6ecd9c0869cf186233e5b0e2b9623022f100867c891ad513fba34a6b

    • SSDEEP

      6144:YGeJ7zuOrSyJ0tpaP8DSdBbUpof2YAxvWKg6jlH3Hu51:YVrSyJ0tp+b/Qpof2YAWqg1

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks