General

  • Target

    d2841724a969172b85c0584c8d949ba9_JaffaCakes118

  • Size

    164KB

  • Sample

    240907-wgwmrawfnp

  • MD5

    d2841724a969172b85c0584c8d949ba9

  • SHA1

    bf34da75ffc915dab03195ebdb30a5adfe646e14

  • SHA256

    af4655e613e21c0a3c5a402e9b5a9f6f07d3156d39d7d126b1f1eff25bf0844a

  • SHA512

    54765513d496672c665f2366fbe3ce8b50220554f4a831d2c0a857412731e43333704df29d4b4d3bd4af8cd0a6b870720cbe07ff5a4b3b46b2eb05e40b7e0558

  • SSDEEP

    3072:9zs7/pAyzfYX1Z16pJdl0WLAYG2RlFJNFxQAcpHInOaHYfjCt:hsrGEQXL1QJdiGdZPFxQLhSOaWj

Malware Config

Extracted

Family

azorult

C2

http://onlydogoodforme.bit/index.php

Targets

    • Target

      d2841724a969172b85c0584c8d949ba9_JaffaCakes118

    • Size

      164KB

    • MD5

      d2841724a969172b85c0584c8d949ba9

    • SHA1

      bf34da75ffc915dab03195ebdb30a5adfe646e14

    • SHA256

      af4655e613e21c0a3c5a402e9b5a9f6f07d3156d39d7d126b1f1eff25bf0844a

    • SHA512

      54765513d496672c665f2366fbe3ce8b50220554f4a831d2c0a857412731e43333704df29d4b4d3bd4af8cd0a6b870720cbe07ff5a4b3b46b2eb05e40b7e0558

    • SSDEEP

      3072:9zs7/pAyzfYX1Z16pJdl0WLAYG2RlFJNFxQAcpHInOaHYfjCt:hsrGEQXL1QJdiGdZPFxQLhSOaWj

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

MITRE ATT&CK Enterprise v15

Tasks