Overview

overview

10

Static

static

1

92821d6dd8...18.exe

windows7-x64

10

92821d6dd8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    92821d6dd83105f5f2d08c43f28fa309_JaffaCakes118

  • Size

    1.8MB

  • Sample

    240603-vcz9pscg8y

  • MD5

    92821d6dd83105f5f2d08c43f28fa309

  • SHA1

    93c72e2494705509b56ca93cea2448aff098cb6d

  • SHA256

    dc3171271adef72e1faf51d68c3c76daaffa9f097ef6d51aa600c98f129209e8

  • SHA512

    47c3a27b5a9fa6273d779ed8afffeb2bbbecab6420708f0ca36629932e1d910e06297839ca39ec01fe7e975a52ed12aaa0e781f5112870e1b7621722e1808c08

  • SSDEEP

    24576:rs50Mmi16DJ14W3a+sGbSeEs50MaRfgLA5TmOKKs50MA2iQZLAdTmOKYLA9TmOKh:rs51AJ1/ks58fgCCKs5A2XaCYKCh

Score
10/10
azorultoskiraccooncf43f57ef5d1c064538f5f9d27891dc66c96dad8infostealerspywarestealertrojan

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

raccoon

Botnet

cf43f57ef5d1c064538f5f9d27891dc66c96dad8

Attributes
  • url4cnc

    https://telete.in/brikitiki

rc4.plain
rc4.plain

Extracted

Family

oski

C2

nadia.ac.ug

Targets

    • Target

      92821d6dd83105f5f2d08c43f28fa309_JaffaCakes118

    • Size

      1.8MB

    • MD5

      92821d6dd83105f5f2d08c43f28fa309

    • SHA1

      93c72e2494705509b56ca93cea2448aff098cb6d

    • SHA256

      dc3171271adef72e1faf51d68c3c76daaffa9f097ef6d51aa600c98f129209e8

    • SHA512

      47c3a27b5a9fa6273d779ed8afffeb2bbbecab6420708f0ca36629932e1d910e06297839ca39ec01fe7e975a52ed12aaa0e781f5112870e1b7621722e1808c08

    • SSDEEP

      24576:rs50Mmi16DJ14W3a+sGbSeEs50MaRfgLA5TmOKKs50MA2iQZLAdTmOKYLA9TmOKh:rs51AJ1/ks58fgCCKs5A2XaCYKCh

    Score
    10/10
    azorultoskiraccooncf43f57ef5d1c064538f5f9d27891dc66c96dad8infostealerspywarestealertrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

      infostealeroski

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer V1 payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks