General

  • Target

    f85df36b63ad125662fb1d4c08dde78a_JaffaCakes118

  • Size

    1.9MB

  • Sample

    240926-ple28swhrr

  • MD5

    f85df36b63ad125662fb1d4c08dde78a

  • SHA1

    e492377577283b0fddc0b5eb4030c3273c7230fa

  • SHA256

    a27ba4f69cb23daece2fc74c5af66556d685790201a1f21abac0e960f6dfc42d

  • SHA512

    25c89ef57c5f07f6d36491d391bab3c66d69cc40afa2d59dcf5b7fd106806f40f76cac8810863ecfa029c63ee048587a50baa58fc74a0cf31eb7a471dcb30ddf

  • SSDEEP

    49152:9h+ZkldoPK8YaIZAzA5NXyBxOzeKS5ZLKHZMq:u2cPK80mAsUzeZLW

Malware Config

Extracted

Family

azorult

C2

http://146.0.41.152/index.php

Targets

    • Target

      f85df36b63ad125662fb1d4c08dde78a_JaffaCakes118

    • Size

      1.9MB

    • MD5

      f85df36b63ad125662fb1d4c08dde78a

    • SHA1

      e492377577283b0fddc0b5eb4030c3273c7230fa

    • SHA256

      a27ba4f69cb23daece2fc74c5af66556d685790201a1f21abac0e960f6dfc42d

    • SHA512

      25c89ef57c5f07f6d36491d391bab3c66d69cc40afa2d59dcf5b7fd106806f40f76cac8810863ecfa029c63ee048587a50baa58fc74a0cf31eb7a471dcb30ddf

    • SSDEEP

      49152:9h+ZkldoPK8YaIZAzA5NXyBxOzeKS5ZLKHZMq:u2cPK80mAsUzeZLW

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks