General
-
Target
fba3461f6277bb26503cf818497cb1c6_JaffaCakes118
-
Size
568KB
-
Sample
240928-gmt9jssflf
-
MD5
fba3461f6277bb26503cf818497cb1c6
-
SHA1
bfd5ace623edc6f1dacce8740c4984179b75fd57
-
SHA256
ed87bd1d238634ebab81a5217156e9999b783b3cca47b1cb4d17c08dbfaad33b
-
SHA512
c5b41528aef4cef928af2768479112e7848384ef2dfaeda0bfc878713c6634a1f62e1779bb3aa5628f0f1a986b9b0aade773ae0b5362642849ffa89531c9edc1
-
SSDEEP
12288:+wAT+Cgp+/fE7hplIV5IVpaUBfG4FFSN7:VF3Y/fE7hplIkpdRWF
Static task
static1
Behavioral task
behavioral1
Sample
fba3461f6277bb26503cf818497cb1c6_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fba3461f6277bb26503cf818497cb1c6_JaffaCakes118.exe
Resource
win10v2004-20240910-en
Malware Config
Extracted
azorult
http://honeypoll.ru/kelv/index.php
Targets
-
-
Target
fba3461f6277bb26503cf818497cb1c6_JaffaCakes118
-
Size
568KB
-
MD5
fba3461f6277bb26503cf818497cb1c6
-
SHA1
bfd5ace623edc6f1dacce8740c4984179b75fd57
-
SHA256
ed87bd1d238634ebab81a5217156e9999b783b3cca47b1cb4d17c08dbfaad33b
-
SHA512
c5b41528aef4cef928af2768479112e7848384ef2dfaeda0bfc878713c6634a1f62e1779bb3aa5628f0f1a986b9b0aade773ae0b5362642849ffa89531c9edc1
-
SSDEEP
12288:+wAT+Cgp+/fE7hplIV5IVpaUBfG4FFSN7:VF3Y/fE7hplIkpdRWF
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-