General

  • Target

    JaffaCakes118_8822bbd08fd84f3d551554abfbfc649619a890b0af65058f086b67ccf54b4a60

  • Size

    623KB

  • Sample

    241230-3psz6axkgw

  • MD5

    4656a0aa21a751df24a0fd9f753ccafe

  • SHA1

    06a163b43ad442f651095da20dc5dca6c1eed3c2

  • SHA256

    8822bbd08fd84f3d551554abfbfc649619a890b0af65058f086b67ccf54b4a60

  • SHA512

    5b7a29f551fbd409ec7fdb12c47764073bdbffb1ce21639e19fdc3e6cc542874cff9d077559f75de058fecd77f7e3d090413ce70d4ae74b42dcb8b510ea12591

  • SSDEEP

    3072:kd3s6hV2zb6nwVSHaO0OKxJ6vdoNGhOzsLc+iYHRAkmtx1uvYsaa8QqbH3Fvz8CL:EzbOKnWHx1a+vz8KiBoJ8LVpdHnk

Malware Config

Extracted

Family

azorult

C2

http://85.202.169.121/mann/index.php

Targets

    • Target

      JaffaCakes118_8822bbd08fd84f3d551554abfbfc649619a890b0af65058f086b67ccf54b4a60

    • Size

      623KB

    • MD5

      4656a0aa21a751df24a0fd9f753ccafe

    • SHA1

      06a163b43ad442f651095da20dc5dca6c1eed3c2

    • SHA256

      8822bbd08fd84f3d551554abfbfc649619a890b0af65058f086b67ccf54b4a60

    • SHA512

      5b7a29f551fbd409ec7fdb12c47764073bdbffb1ce21639e19fdc3e6cc542874cff9d077559f75de058fecd77f7e3d090413ce70d4ae74b42dcb8b510ea12591

    • SSDEEP

      3072:kd3s6hV2zb6nwVSHaO0OKxJ6vdoNGhOzsLc+iYHRAkmtx1uvYsaa8QqbH3Fvz8CL:EzbOKnWHx1a+vz8KiBoJ8LVpdHnk

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Azorult family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks