Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30-08-2024 12:30
General
-
Target
cad776cd03db4ba1f9ae05a62930ad28_JaffaCakes118.exe
-
Size
4.7MB
-
MD5
cad776cd03db4ba1f9ae05a62930ad28
-
SHA1
bd854ad7dbe3a348f1ca8c42215624c50da0a581
-
SHA256
e28ed167658b644a68b29997cf44b98d57af1b8c87dce864f39ff3de8453fceb
-
SHA512
ab0704bc9320e3bd77f4cd1fa20fe27924ece82f94689fb1e2b0120e64f87d99aada150f7dfa8cf7699a86ea6637988ee0f78e62cea4a7015da1f38ca6fb4ae3
-
SSDEEP
98304:RfiwlLEytI5Iwe+CL9fHp5mkBydF/8iYwbT9FVhCdXO2z:R9ayOZyR/p0kaFksPVhCdXO6
Malware Config
Extracted
azorult
http://pafospanel.zzz.com.ua/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cad776cd03db4ba1f9ae05a62930ad28_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cad776cd03db4ba1f9ae05a62930ad28_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
-
Filesize
7.6MB
-
Filesize
7.6MB
-
Filesize
4KB
-
Filesize
7.6MB
-
Filesize
2.8MB
-
Filesize
7.6MB