General

  • Target

    9d043e124298e99a5e49df6fc0868463_JaffaCakes118

  • Size

    541KB

  • Sample

    240611-feskbavhpn

  • MD5

    9d043e124298e99a5e49df6fc0868463

  • SHA1

    9b75c08b1de6c4fa2618be2f29e252a49080dc0f

  • SHA256

    48ce6c67da546ac753e2cec2ead479967b236687efa5c89d4dbc2d2bb1594542

  • SHA512

    fa425629c91072f4e9c6e231dcda732ab824f3c04a0ae6b5e5e4a0d2aad6f92056438952bdb4a33bc1d0c8b500c6f68fcf4826d474e49b6585fcce8b224f1bdf

  • SSDEEP

    12288:0PQElQKyeq54mC5aoOI1CjzXVvHnR9EM7yV:kQaW4m1jzXP7K

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Targets

    • Target

      9d043e124298e99a5e49df6fc0868463_JaffaCakes118

    • Size

      541KB

    • MD5

      9d043e124298e99a5e49df6fc0868463

    • SHA1

      9b75c08b1de6c4fa2618be2f29e252a49080dc0f

    • SHA256

      48ce6c67da546ac753e2cec2ead479967b236687efa5c89d4dbc2d2bb1594542

    • SHA512

      fa425629c91072f4e9c6e231dcda732ab824f3c04a0ae6b5e5e4a0d2aad6f92056438952bdb4a33bc1d0c8b500c6f68fcf4826d474e49b6585fcce8b224f1bdf

    • SSDEEP

      12288:0PQElQKyeq54mC5aoOI1CjzXVvHnR9EM7yV:kQaW4m1jzXP7K

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks