Overview

overview

10

Static

static

3

8742787359...18.exe

windows7-x64

10

8742787359...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    87427873598149b0fa487fa5d101965e_JaffaCakes118

  • Size

    579KB

  • Sample

    240531-rd2mdabe32

  • MD5

    87427873598149b0fa487fa5d101965e

  • SHA1

    bf42f8cf20d0afaea14536fc177448d8641746aa

  • SHA256

    b52125b4a4b5b6d52dbce95c1100cc7a1e1d2d978f6f3e31ecf227a626e79470

  • SHA512

    eef38f31cfb529f28c19589590f5770f9ba62b3d8399478dcd0c3ac56eb9063ac58d51e0a4e4bfa7ac0551ae1f146944243af00015224ffd5da7a57fee460427

  • SSDEEP

    12288:Ks9S0TlGJRR5j7jwq+YKy6BNuzfHyuycwS6D/:XZ0Fjy6+0rMcr0

Score
10/10
azorultzgratinfostealerrattrojan

Malware Config

Extracted

Family

azorult

C2

http://185.202.175.53/index.php

Targets

    • Target

      87427873598149b0fa487fa5d101965e_JaffaCakes118

    • Size

      579KB

    • MD5

      87427873598149b0fa487fa5d101965e

    • SHA1

      bf42f8cf20d0afaea14536fc177448d8641746aa

    • SHA256

      b52125b4a4b5b6d52dbce95c1100cc7a1e1d2d978f6f3e31ecf227a626e79470

    • SHA512

      eef38f31cfb529f28c19589590f5770f9ba62b3d8399478dcd0c3ac56eb9063ac58d51e0a4e4bfa7ac0551ae1f146944243af00015224ffd5da7a57fee460427

    • SSDEEP

      12288:Ks9S0TlGJRR5j7jwq+YKy6BNuzfHyuycwS6D/:XZ0Fjy6+0rMcr0

    Score
    10/10
    azorultzgratinfostealerrattrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Detect ZGRat V2

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Drops startup file

    • Blocklisted process makes network request

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks