General

  • Target

    ea51aade58d241c3504d4ea8190ead9b_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240919-blvk2atarp

  • MD5

    ea51aade58d241c3504d4ea8190ead9b

  • SHA1

    945684f37c73da7c66bf296b2f846cc9eee2ace3

  • SHA256

    b439769c10bdaade1b16c9472eabeaaed21fede1bce1fb164091bb9ad926d15a

  • SHA512

    0288571529a12735af51d9c40d857962ba49ed63ba458e0a4bee4e9f1c7ba806d00d8f58dfa835aa82d2f888e0e5647fc12d36511a9b4b1fbec59f0a9fa7876f

  • SSDEEP

    24576:Yu6J33O0c+JY5UZ+XC0kGso6Faag6vQ9U9tWpz2z80DHB1bW2kWY:Su0c++OCvkGs9FaUwk1a4Y

Malware Config

Extracted

Family

azorult

C2

http://mytrafvip.host/errors/index.php

Targets

    • Target

      ea51aade58d241c3504d4ea8190ead9b_JaffaCakes118

    • Size

      1.3MB

    • MD5

      ea51aade58d241c3504d4ea8190ead9b

    • SHA1

      945684f37c73da7c66bf296b2f846cc9eee2ace3

    • SHA256

      b439769c10bdaade1b16c9472eabeaaed21fede1bce1fb164091bb9ad926d15a

    • SHA512

      0288571529a12735af51d9c40d857962ba49ed63ba458e0a4bee4e9f1c7ba806d00d8f58dfa835aa82d2f888e0e5647fc12d36511a9b4b1fbec59f0a9fa7876f

    • SSDEEP

      24576:Yu6J33O0c+JY5UZ+XC0kGso6Faag6vQ9U9tWpz2z80DHB1bW2kWY:Su0c++OCvkGs9FaUwk1a4Y

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks