General

  • Target

    d265298cd4768bea2c6d00ff2169eb2e_JaffaCakes118

  • Size

    1.5MB

  • Sample

    240907-va526swcqh

  • MD5

    d265298cd4768bea2c6d00ff2169eb2e

  • SHA1

    3d81f35339dc0a4021ef08b6c922a1976d973036

  • SHA256

    67ddeda45c8cfdd39c7d2ef1c9c29075430ff1cd486795a59a277b585ef2193a

  • SHA512

    9bd9503454c9343117065867a3db9aa348fae7c1828c9e2db29c8e576f20c6fc5149c3a580455e5493baa891befd12dbef66fa31dd3afb056d682001a267da32

  • SSDEEP

    24576:JRmJkcoQricOIQxiZY1OdZ2+2y7VXWsgmPm3YSYjs6vbjTiHOQ:GJZoQrbTFZY1OdZ2nsgi7VHzjTQR

Malware Config

Extracted

Family

azorult

C2

http://controlenter.bikeandcarprice.com/wp/index.php

Targets

    • Target

      d265298cd4768bea2c6d00ff2169eb2e_JaffaCakes118

    • Size

      1.5MB

    • MD5

      d265298cd4768bea2c6d00ff2169eb2e

    • SHA1

      3d81f35339dc0a4021ef08b6c922a1976d973036

    • SHA256

      67ddeda45c8cfdd39c7d2ef1c9c29075430ff1cd486795a59a277b585ef2193a

    • SHA512

      9bd9503454c9343117065867a3db9aa348fae7c1828c9e2db29c8e576f20c6fc5149c3a580455e5493baa891befd12dbef66fa31dd3afb056d682001a267da32

    • SSDEEP

      24576:JRmJkcoQricOIQxiZY1OdZ2+2y7VXWsgmPm3YSYjs6vbjTiHOQ:GJZoQrbTFZY1OdZ2nsgi7VHzjTQR

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks