General

  • Target

    a9e8a5df8f5b3bd44970564405c479f2_JaffaCakes118

  • Size

    392KB

  • Sample

    240614-qp1nsawekm

  • MD5

    a9e8a5df8f5b3bd44970564405c479f2

  • SHA1

    950c80b230201590b8ca637c3d45f0fba5eca72a

  • SHA256

    24a74c858b9e16322e848c84a2e9e915f493da9580b5f4653eb236c836484738

  • SHA512

    6f3b289425f7f97b1e512c0b297f1720a637f58f7ae85eb0ba6d40629007425e350356a22f356d8756f07af610c8764ac6d54733002292634aee39b46f89ab41

  • SSDEEP

    6144:jkLW60igYbJJL7XJAnY7mRoJfeCvDAP/lYHdzQ:wLW60ixFJHX+nOcmfeWc+u

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Targets

    • Target

      a9e8a5df8f5b3bd44970564405c479f2_JaffaCakes118

    • Size

      392KB

    • MD5

      a9e8a5df8f5b3bd44970564405c479f2

    • SHA1

      950c80b230201590b8ca637c3d45f0fba5eca72a

    • SHA256

      24a74c858b9e16322e848c84a2e9e915f493da9580b5f4653eb236c836484738

    • SHA512

      6f3b289425f7f97b1e512c0b297f1720a637f58f7ae85eb0ba6d40629007425e350356a22f356d8756f07af610c8764ac6d54733002292634aee39b46f89ab41

    • SSDEEP

      6144:jkLW60igYbJJL7XJAnY7mRoJfeCvDAP/lYHdzQ:wLW60ixFJHX+nOcmfeWc+u

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks