General
-
Target
9d043e124298e99a5e49df6fc0868463_JaffaCakes118
-
Size
541KB
-
Sample
240611-feskbavhpn
-
MD5
9d043e124298e99a5e49df6fc0868463
-
SHA1
9b75c08b1de6c4fa2618be2f29e252a49080dc0f
-
SHA256
48ce6c67da546ac753e2cec2ead479967b236687efa5c89d4dbc2d2bb1594542
-
SHA512
fa425629c91072f4e9c6e231dcda732ab824f3c04a0ae6b5e5e4a0d2aad6f92056438952bdb4a33bc1d0c8b500c6f68fcf4826d474e49b6585fcce8b224f1bdf
-
SSDEEP
12288:0PQElQKyeq54mC5aoOI1CjzXVvHnR9EM7yV:kQaW4m1jzXP7K
Static task
static1
Behavioral task
behavioral1
Sample
9d043e124298e99a5e49df6fc0868463_JaffaCakes118.ps1
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9d043e124298e99a5e49df6fc0868463_JaffaCakes118.ps1
Resource
win10v2004-20240508-en
Malware Config
Extracted
azorult
http://195.245.112.115/index.php
Targets
-
-
Target
9d043e124298e99a5e49df6fc0868463_JaffaCakes118
-
Size
541KB
-
MD5
9d043e124298e99a5e49df6fc0868463
-
SHA1
9b75c08b1de6c4fa2618be2f29e252a49080dc0f
-
SHA256
48ce6c67da546ac753e2cec2ead479967b236687efa5c89d4dbc2d2bb1594542
-
SHA512
fa425629c91072f4e9c6e231dcda732ab824f3c04a0ae6b5e5e4a0d2aad6f92056438952bdb4a33bc1d0c8b500c6f68fcf4826d474e49b6585fcce8b224f1bdf
-
SSDEEP
12288:0PQElQKyeq54mC5aoOI1CjzXVvHnR9EM7yV:kQaW4m1jzXP7K
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-