General

  • Target

    ab95b07eeb30a98ec33aa2cb0c8d7929_JaffaCakes118

  • Size

    684KB

  • Sample

    240614-1htl1axara

  • MD5

    ab95b07eeb30a98ec33aa2cb0c8d7929

  • SHA1

    6d8871a497703d5f7c5437c22d7cd73231460d44

  • SHA256

    d7d7ee33a95fb43312bf1ebe4e7a106ddfb5ef80097137cc2c87a014acc7e629

  • SHA512

    0a19d5f3f16ab4e675e7370d300902f8a947c1cdb1b64d85e5493d3664a0ade1e965fbb92d9397f75413968a5c288a7f9644b4adcdabe4df798b7faf0e3fbb3d

  • SSDEEP

    12288:3hoqeAQCtaNBoQLsivV4aURL3LtRFOQBfVb08aOso295bl7k4FWVluBUZSaHyOCu:qPCk1BFe

Malware Config

Extracted

Family

azorult

C2

http://888security.ru/c0visteal/index.php

Targets

    • Target

      ab95b07eeb30a98ec33aa2cb0c8d7929_JaffaCakes118

    • Size

      684KB

    • MD5

      ab95b07eeb30a98ec33aa2cb0c8d7929

    • SHA1

      6d8871a497703d5f7c5437c22d7cd73231460d44

    • SHA256

      d7d7ee33a95fb43312bf1ebe4e7a106ddfb5ef80097137cc2c87a014acc7e629

    • SHA512

      0a19d5f3f16ab4e675e7370d300902f8a947c1cdb1b64d85e5493d3664a0ade1e965fbb92d9397f75413968a5c288a7f9644b4adcdabe4df798b7faf0e3fbb3d

    • SSDEEP

      12288:3hoqeAQCtaNBoQLsivV4aURL3LtRFOQBfVb08aOso295bl7k4FWVluBUZSaHyOCu:qPCk1BFe

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks