General

  • Target

    e158679eb30517f76adf2c688489f033_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240915-atj9lawblb

  • MD5

    e158679eb30517f76adf2c688489f033

  • SHA1

    9e8687e934afe270ec543545db1484afc96ab648

  • SHA256

    4bbb2ddc560264fc1b9de6a13f6eacf5548eec505813e5a0f1b8496f7a4ed90c

  • SHA512

    cf6a418b0fe5e6bb404874eafbd710d335392654560521775d267f4cffefa68779e55be532608d168ef2d1234387b3d1c2fd63959ba385eefdb5a8dcb2493579

  • SSDEEP

    24576:1AHnh+eWsN3skA4RV1Hom2KXMmHas3SlnRQ05:kh+ZkldoPK8YasW

Malware Config

Extracted

Family

azorult

C2

http://151.106.27.237/index.php

Targets

    • Target

      e158679eb30517f76adf2c688489f033_JaffaCakes118

    • Size

      1.1MB

    • MD5

      e158679eb30517f76adf2c688489f033

    • SHA1

      9e8687e934afe270ec543545db1484afc96ab648

    • SHA256

      4bbb2ddc560264fc1b9de6a13f6eacf5548eec505813e5a0f1b8496f7a4ed90c

    • SHA512

      cf6a418b0fe5e6bb404874eafbd710d335392654560521775d267f4cffefa68779e55be532608d168ef2d1234387b3d1c2fd63959ba385eefdb5a8dcb2493579

    • SSDEEP

      24576:1AHnh+eWsN3skA4RV1Hom2KXMmHas3SlnRQ05:kh+ZkldoPK8YasW

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks