General

  • Target

    9fa7337097dbed06862cda685c20f891_JaffaCakes118

  • Size

    220KB

  • Sample

    240611-1rxd9atapq

  • MD5

    9fa7337097dbed06862cda685c20f891

  • SHA1

    9ce56f8fce38269cdf938843cde5a9a9e91f2f76

  • SHA256

    8dc1edf0bb68900fcc9f43e1e93c2c30839eec5da70b0aba37228f444c9e4e81

  • SHA512

    f45d503574799b548010b43c76480e7d5e1236cbe244b479e95a375c3e642d35fbdfbe27e8a24d60b306812c55b4d7da3213ca84cc32092fac8c9903ec3ea2a2

  • SSDEEP

    6144:8nUVY1KxhE/5CPEWwPDvz/IG2TdkKSaoeoS:8UVYcYCTOvLMxkKdoS

Malware Config

Extracted

Family

azorult

C2

http://5.45.77.6/index.php

Targets

    • Target

      9fa7337097dbed06862cda685c20f891_JaffaCakes118

    • Size

      220KB

    • MD5

      9fa7337097dbed06862cda685c20f891

    • SHA1

      9ce56f8fce38269cdf938843cde5a9a9e91f2f76

    • SHA256

      8dc1edf0bb68900fcc9f43e1e93c2c30839eec5da70b0aba37228f444c9e4e81

    • SHA512

      f45d503574799b548010b43c76480e7d5e1236cbe244b479e95a375c3e642d35fbdfbe27e8a24d60b306812c55b4d7da3213ca84cc32092fac8c9903ec3ea2a2

    • SSDEEP

      6144:8nUVY1KxhE/5CPEWwPDvz/IG2TdkKSaoeoS:8UVYcYCTOvLMxkKdoS

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks