General

  • Target

    11f6a0abb4c7f875a3439bae8bb39e18_JaffaCakes118

  • Size

    367KB

  • Sample

    241004-fsrj6szepe

  • MD5

    11f6a0abb4c7f875a3439bae8bb39e18

  • SHA1

    6537bb2ffd744e2df4dd039f1eede158a07bb0a6

  • SHA256

    bf966d13284110cce7566e9f85da40a376fc599abc0047f9ef3b34639b89513b

  • SHA512

    5e84043796335211ffb59b74f5c58513d4e74208c0ae993ec468894ffa6447244a401e0d2030879ebe58c801a41c1c197cc36389054f9ce0b756048c2e05c03f

  • SSDEEP

    6144:oXyTPC32u9ZDcFB4FJ88unK8KftjqM6raQ:kyTPCr9aT4FJYnkf5maQ

Malware Config

Extracted

Family

azorult

C2

http://185.79.156.18/gka/index.php

Targets

    • Target

      11f6a0abb4c7f875a3439bae8bb39e18_JaffaCakes118

    • Size

      367KB

    • MD5

      11f6a0abb4c7f875a3439bae8bb39e18

    • SHA1

      6537bb2ffd744e2df4dd039f1eede158a07bb0a6

    • SHA256

      bf966d13284110cce7566e9f85da40a376fc599abc0047f9ef3b34639b89513b

    • SHA512

      5e84043796335211ffb59b74f5c58513d4e74208c0ae993ec468894ffa6447244a401e0d2030879ebe58c801a41c1c197cc36389054f9ce0b756048c2e05c03f

    • SSDEEP

      6144:oXyTPC32u9ZDcFB4FJ88unK8KftjqM6raQ:kyTPCr9aT4FJYnkf5maQ

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks