General

  • Target

    cf3df27c1cad3d0f276238dc62a8fe05_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240906-ll2pfsygnp

  • MD5

    cf3df27c1cad3d0f276238dc62a8fe05

  • SHA1

    48cae76d1a530bae38f15f9e2b1a2fc6970b0aaf

  • SHA256

    f4dc8f7e1d2c7eef935258522ef2f0c4b646e8cf13f7aac962fdc789f2d32c99

  • SHA512

    9cf0bb43a042b5be79865f5945cdd63335a06591fea9e039b273224013218e338516d11661128a248e6528c47d0f9b9c4513fc512da3f6f8ffe48f3d8ebb99fb

  • SSDEEP

    24576:ldHPXnvcC964ukjOs1iq8ZqI1IT96tb6ePyWfzGJn8ECEV:l9vvM4sHq9QPTLqp

Malware Config

Extracted

Family

azorult

C2

http://bixtoj.gq/sc01/index.php

Targets

    • Target

      cf3df27c1cad3d0f276238dc62a8fe05_JaffaCakes118

    • Size

      1.1MB

    • MD5

      cf3df27c1cad3d0f276238dc62a8fe05

    • SHA1

      48cae76d1a530bae38f15f9e2b1a2fc6970b0aaf

    • SHA256

      f4dc8f7e1d2c7eef935258522ef2f0c4b646e8cf13f7aac962fdc789f2d32c99

    • SHA512

      9cf0bb43a042b5be79865f5945cdd63335a06591fea9e039b273224013218e338516d11661128a248e6528c47d0f9b9c4513fc512da3f6f8ffe48f3d8ebb99fb

    • SSDEEP

      24576:ldHPXnvcC964ukjOs1iq8ZqI1IT96tb6ePyWfzGJn8ECEV:l9vvM4sHq9QPTLqp

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks