General

  • Target

    a6fbdbd819bab362066048e1cd6e30bf_JaffaCakes118

  • Size

    310KB

  • Sample

    241127-ksmnfawpfs

  • MD5

    a6fbdbd819bab362066048e1cd6e30bf

  • SHA1

    759316af53f1fa9c1c0118d157ce730e8f830b30

  • SHA256

    98923f07009b4e65ca98551ee14d38910fc102d4d075fa590633c2a74a98976d

  • SHA512

    a6bbebb64ea7dd961ea437651fab8edd39efd765ecd8343cd332452b0ef80554422f4149995929ca8097d6c7f67c8ffc16f297de22500fefe3c0decfb9f89e1a

  • SSDEEP

    3072:8UBYZzcERJ6IVMgnKHuLW+dct7S5xtZqleMe3FzlxrfWbrcEOQR1jkfQsCFgmyow:iztJr3LWwUS5jZq01z/r8ruQR1jkIDw

Malware Config

Extracted

Family

azorult

C2

http://bloodmood.bit/p/index.php

Targets

    • Target

      a6fbdbd819bab362066048e1cd6e30bf_JaffaCakes118

    • Size

      310KB

    • MD5

      a6fbdbd819bab362066048e1cd6e30bf

    • SHA1

      759316af53f1fa9c1c0118d157ce730e8f830b30

    • SHA256

      98923f07009b4e65ca98551ee14d38910fc102d4d075fa590633c2a74a98976d

    • SHA512

      a6bbebb64ea7dd961ea437651fab8edd39efd765ecd8343cd332452b0ef80554422f4149995929ca8097d6c7f67c8ffc16f297de22500fefe3c0decfb9f89e1a

    • SSDEEP

      3072:8UBYZzcERJ6IVMgnKHuLW+dct7S5xtZqleMe3FzlxrfWbrcEOQR1jkfQsCFgmyow:iztJr3LWwUS5jZq01z/r8ruQR1jkIDw

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Azorult family

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

MITRE ATT&CK Enterprise v15

Tasks