General

  • Target

    JaffaCakes118_6d698a8b8b3bdae69d429d3dccdd3cdf209b2d1917e30b8e75f98d609c402731

  • Size

    338KB

  • Sample

    241225-xae7vssqaj

  • MD5

    97510a2dc71cf37b2c01432a4fb8232f

  • SHA1

    5691a36608ac76ed81b949dad81fd5846bb8c2a7

  • SHA256

    6d698a8b8b3bdae69d429d3dccdd3cdf209b2d1917e30b8e75f98d609c402731

  • SHA512

    36be46cd97431cddc866e7d2601a78acbb745468a7db580e195c7df1134afb89d8efd2033a0f93985762b028b8d96067b90ddc066596315fce17630cb4fe8b03

  • SSDEEP

    6144:Kq3IShElJb2xm83G3JnDyhADSNNm1TxUgKNXyeJ1ae5HV5rnqs:S/5eWxqAmLKxUNLJsex3nx

Malware Config

Extracted

Family

azorult

C2

http://vatanhurdacilik.com/suniz/index.php

Targets

    • Target

      a32901c6438f87f513547efcf8d5b83f703e8a5d61e10cbc97b3cd6f537555e8

    • Size

      381KB

    • MD5

      2135923cb96b66f87fe36b4aa52d0581

    • SHA1

      b832b8a4bc6906eb76642402e3f0996952d26051

    • SHA256

      a32901c6438f87f513547efcf8d5b83f703e8a5d61e10cbc97b3cd6f537555e8

    • SHA512

      396af205c9fa09092a95e4a7232f2622054fb9525d538c24e74ab99b31f21802632bd53b46badd3c5e735774dc0cd1dca834a8445daf3b6e7e5b9a4bd45ce55d

    • SSDEEP

      6144:WYkzPgG2y62xBSsZo4+z7sTDJ+M/tlb4xgxETDwHdlo2pn0RrAtRjsmlPBLM/y:WYkz33663Zp+z7iJnFR4mxEA9lbpn0pq

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Azorult family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks