General

  • Target

    c34216a0b098100549a990bccc6c076d_JaffaCakes118

  • Size

    459KB

  • Sample

    240826-sljbfazgpe

  • MD5

    c34216a0b098100549a990bccc6c076d

  • SHA1

    c4d0ed1ca0e6111e900a14bd85375dd375b876c9

  • SHA256

    6400283b54db6e1202ca0902e7e0e3f20a44864a44e3abcc970fcfce9ccaca54

  • SHA512

    0ed47ef84089a74629be7c7b3eeeda921f033262597448161199a3adf07884cf3b07bd1184027dc93956b0eb4a1bc7fb0d9f4d0caea8a961162126d2f99c7dc5

  • SSDEEP

    3072:tNH5paxbN+7Sz7gItbISy/ZFpCXhg3n+3e:PX4N+SPtbH0ZFIh0+3

Malware Config

Extracted

Family

azorult

C2

https://romanone.com/wp-content/okoye/32/index.php

Targets

    • Target

      c34216a0b098100549a990bccc6c076d_JaffaCakes118

    • Size

      459KB

    • MD5

      c34216a0b098100549a990bccc6c076d

    • SHA1

      c4d0ed1ca0e6111e900a14bd85375dd375b876c9

    • SHA256

      6400283b54db6e1202ca0902e7e0e3f20a44864a44e3abcc970fcfce9ccaca54

    • SHA512

      0ed47ef84089a74629be7c7b3eeeda921f033262597448161199a3adf07884cf3b07bd1184027dc93956b0eb4a1bc7fb0d9f4d0caea8a961162126d2f99c7dc5

    • SSDEEP

      3072:tNH5paxbN+7Sz7gItbISy/ZFpCXhg3n+3e:PX4N+SPtbH0ZFIh0+3

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks