General

  • Target

    0c86c579bc63a51639e950e3449691b0_JaffaCakes118

  • Size

    675KB

  • Sample

    240728-g5qn3swckf

  • MD5

    0c86c579bc63a51639e950e3449691b0

  • SHA1

    29b1f8e35588c0fbf8e7a31847e60fe3ca525786

  • SHA256

    f6b7e42150aea95c6af1e8c570ca45fac6e7e7dc2b27a88cae25fbc92faa07ff

  • SHA512

    e57a8bb805df1a0a13cb33fd1208233cfe405ad93d2b887452ddff09fd7b1b55ba1a86ad9e0fe9a29e34ef66cd06ddb8e1a23ba79159663369af63c0e8025faa

  • SSDEEP

    12288:WOL2EC+KNAlnSVi4dVNkKQqdiuV7a+u9LjyXahGZ3KIpWjV:WGRYAlnG7T9V7a71j8oW1pa

Malware Config

Extracted

Family

azorult

C2

http://ciuj.ir/arnold/index.php

Targets

    • Target

      0c86c579bc63a51639e950e3449691b0_JaffaCakes118

    • Size

      675KB

    • MD5

      0c86c579bc63a51639e950e3449691b0

    • SHA1

      29b1f8e35588c0fbf8e7a31847e60fe3ca525786

    • SHA256

      f6b7e42150aea95c6af1e8c570ca45fac6e7e7dc2b27a88cae25fbc92faa07ff

    • SHA512

      e57a8bb805df1a0a13cb33fd1208233cfe405ad93d2b887452ddff09fd7b1b55ba1a86ad9e0fe9a29e34ef66cd06ddb8e1a23ba79159663369af63c0e8025faa

    • SSDEEP

      12288:WOL2EC+KNAlnSVi4dVNkKQqdiuV7a+u9LjyXahGZ3KIpWjV:WGRYAlnG7T9V7a71j8oW1pa

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks