General
-
Target
a9e8a5df8f5b3bd44970564405c479f2_JaffaCakes118
-
Size
392KB
-
Sample
240614-qp1nsawekm
-
MD5
a9e8a5df8f5b3bd44970564405c479f2
-
SHA1
950c80b230201590b8ca637c3d45f0fba5eca72a
-
SHA256
24a74c858b9e16322e848c84a2e9e915f493da9580b5f4653eb236c836484738
-
SHA512
6f3b289425f7f97b1e512c0b297f1720a637f58f7ae85eb0ba6d40629007425e350356a22f356d8756f07af610c8764ac6d54733002292634aee39b46f89ab41
-
SSDEEP
6144:jkLW60igYbJJL7XJAnY7mRoJfeCvDAP/lYHdzQ:wLW60ixFJHX+nOcmfeWc+u
Static task
static1
Behavioral task
behavioral1
Sample
a9e8a5df8f5b3bd44970564405c479f2_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a9e8a5df8f5b3bd44970564405c479f2_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
azorult
http://195.245.112.115/index.php
Targets
-
-
Target
a9e8a5df8f5b3bd44970564405c479f2_JaffaCakes118
-
Size
392KB
-
MD5
a9e8a5df8f5b3bd44970564405c479f2
-
SHA1
950c80b230201590b8ca637c3d45f0fba5eca72a
-
SHA256
24a74c858b9e16322e848c84a2e9e915f493da9580b5f4653eb236c836484738
-
SHA512
6f3b289425f7f97b1e512c0b297f1720a637f58f7ae85eb0ba6d40629007425e350356a22f356d8756f07af610c8764ac6d54733002292634aee39b46f89ab41
-
SSDEEP
6144:jkLW60igYbJJL7XJAnY7mRoJfeCvDAP/lYHdzQ:wLW60ixFJHX+nOcmfeWc+u
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of SetThreadContext
-