General

  • Target

    2d026a6cd90f55852d5a199de0064759_JaffaCakes118

  • Size

    599KB

  • Sample

    241009-h1mmaswfmh

  • MD5

    2d026a6cd90f55852d5a199de0064759

  • SHA1

    d5aec33575e3ac448f8cf1196c667fd0eb4afa46

  • SHA256

    36dd57a848db88e2827b3856c41635e7a85e0de3017ff4583e82b99e654a0bbf

  • SHA512

    01b8be28cc7d24020ab5fa8869237ea80cd5195f44799827d6543eff628c50aaf91b807f541285612a6673d5873d21ec5c2f51e195334e37178f40494b08b771

  • SSDEEP

    12288:4dlKO6aAdtm9tzuXCzXDUOIptgzMYTmsVHzjL8DP:qMaAdtmvqSz+goYTfVcP

Malware Config

Extracted

Family

azorult

C2

http://37.0.10.102/rut/index.php

Targets

    • Target

      2d026a6cd90f55852d5a199de0064759_JaffaCakes118

    • Size

      599KB

    • MD5

      2d026a6cd90f55852d5a199de0064759

    • SHA1

      d5aec33575e3ac448f8cf1196c667fd0eb4afa46

    • SHA256

      36dd57a848db88e2827b3856c41635e7a85e0de3017ff4583e82b99e654a0bbf

    • SHA512

      01b8be28cc7d24020ab5fa8869237ea80cd5195f44799827d6543eff628c50aaf91b807f541285612a6673d5873d21ec5c2f51e195334e37178f40494b08b771

    • SSDEEP

      12288:4dlKO6aAdtm9tzuXCzXDUOIptgzMYTmsVHzjL8DP:qMaAdtmvqSz+goYTfVcP

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks