General

  • Target

    JaffaCakes118_5639363353a4dcf957c52abba6b49501ac8d6dde78e338842f8301165284c3a0

  • Size

    137KB

  • Sample

    241230-hde9ps1khr

  • MD5

    7c30adc99f97a5d8c691f168a9a5a917

  • SHA1

    f93821fdc95212e7a497c2cf07f98e1c77a5ed75

  • SHA256

    5639363353a4dcf957c52abba6b49501ac8d6dde78e338842f8301165284c3a0

  • SHA512

    bf0c1b57da2c8fbfb9c3c7e88150fba6773ceef98e11f6cf151e22de16f496ab1bfddadab7a232d7c221d4d11b8095049e4a7329e39593eb0baf06ce306a5d03

  • SSDEEP

    3072:vG9a1+zJrMbGjvMaGpK4vHUwu7u7EbHizE:vc0GjvnB4vHWi7EL/

Malware Config

Extracted

Family

azorult

C2

http://45.95.168.162/city/index.php

Targets

    • Target

      5308f89ea6ae9b511d38eaf32f0352c06279190262618737aeae66c24e4af7bd.exe

    • Size

      218KB

    • MD5

      415a0770a8f5e60a5fb408ebf360f6db

    • SHA1

      679b46c5d0bc11608aa21636b3c11ac75ee0e6c5

    • SHA256

      5308f89ea6ae9b511d38eaf32f0352c06279190262618737aeae66c24e4af7bd

    • SHA512

      0c059bbc1f4b684b15629cc6e5c2a2eac8ba89db5ae54286e0286b0f35a779af9a5a026ba26a821fcaccd6ec33586637cac32ba41bb79a3c4d08759663df31b5

    • SSDEEP

      6144:mnIR+VhX35mOtbF9CZCLRdJiiOOAOy/D:mIRWN5btbBLRziidAO

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Azorult family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks