General

  • Target

    a52268fe42089ceac66a0654189e5398_JaffaCakes118

  • Size

    981KB

  • Sample

    240613-mr4xfazalm

  • MD5

    a52268fe42089ceac66a0654189e5398

  • SHA1

    dce6e3b3b45264652d8cce826903e481ad382fa5

  • SHA256

    f3f86542a591552a94e41866410910210c0dc2a6d896656e1aeb4651f437d1b9

  • SHA512

    224a9cf104b55f0f5fc27a349cc5cf53024b0e1d74899e68e1cccdc2d5a34883f0dc20d82e1830cb46446cc8dde0ba9b57e870e1da51f3d5c10a6806725df064

  • SSDEEP

    12288:QuYTH9VODZg3q9uUppvoVOso7S18HBvJuXj4PxCP3uzpbRf5zcBXsb85nSwwm:QuiHAZIqJvokl5gXj4PxCP3Ozf6aQnS8

Malware Config

Extracted

Family

azorult

C2

http://llkty.gq/16/index.php

Targets

    • Target

      a52268fe42089ceac66a0654189e5398_JaffaCakes118

    • Size

      981KB

    • MD5

      a52268fe42089ceac66a0654189e5398

    • SHA1

      dce6e3b3b45264652d8cce826903e481ad382fa5

    • SHA256

      f3f86542a591552a94e41866410910210c0dc2a6d896656e1aeb4651f437d1b9

    • SHA512

      224a9cf104b55f0f5fc27a349cc5cf53024b0e1d74899e68e1cccdc2d5a34883f0dc20d82e1830cb46446cc8dde0ba9b57e870e1da51f3d5c10a6806725df064

    • SSDEEP

      12288:QuYTH9VODZg3q9uUppvoVOso7S18HBvJuXj4PxCP3uzpbRf5zcBXsb85nSwwm:QuiHAZIqJvokl5gXj4PxCP3Ozf6aQnS8

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks