General

  • Target

    fba3461f6277bb26503cf818497cb1c6_JaffaCakes118

  • Size

    568KB

  • Sample

    240928-gmt9jssflf

  • MD5

    fba3461f6277bb26503cf818497cb1c6

  • SHA1

    bfd5ace623edc6f1dacce8740c4984179b75fd57

  • SHA256

    ed87bd1d238634ebab81a5217156e9999b783b3cca47b1cb4d17c08dbfaad33b

  • SHA512

    c5b41528aef4cef928af2768479112e7848384ef2dfaeda0bfc878713c6634a1f62e1779bb3aa5628f0f1a986b9b0aade773ae0b5362642849ffa89531c9edc1

  • SSDEEP

    12288:+wAT+Cgp+/fE7hplIV5IVpaUBfG4FFSN7:VF3Y/fE7hplIkpdRWF

Malware Config

Extracted

Family

azorult

C2

http://honeypoll.ru/kelv/index.php

Targets

    • Target

      fba3461f6277bb26503cf818497cb1c6_JaffaCakes118

    • Size

      568KB

    • MD5

      fba3461f6277bb26503cf818497cb1c6

    • SHA1

      bfd5ace623edc6f1dacce8740c4984179b75fd57

    • SHA256

      ed87bd1d238634ebab81a5217156e9999b783b3cca47b1cb4d17c08dbfaad33b

    • SHA512

      c5b41528aef4cef928af2768479112e7848384ef2dfaeda0bfc878713c6634a1f62e1779bb3aa5628f0f1a986b9b0aade773ae0b5362642849ffa89531c9edc1

    • SSDEEP

      12288:+wAT+Cgp+/fE7hplIV5IVpaUBfG4FFSN7:VF3Y/fE7hplIkpdRWF

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks