General
-
Target
0063702f6d07cff9f160edab6793b7e8_JaffaCakes118
-
Size
740KB
-
Sample
240328-h8abyada88
-
MD5
0063702f6d07cff9f160edab6793b7e8
-
SHA1
7eebdea0a348f84d235dcb420fb0f889495d0a66
-
SHA256
74af7154e682ceb0847587d3579e930b85b1a2543b281708c6530049047387fb
-
SHA512
793f94a507eea5a2f9aa1735c45382fd5fcc82acdf4f1cb4fd04e361609b21f5d63a2d159b5cbc70315074ef7f68680bd9a4b19ca3df6fde5ec0775128bd504d
-
SSDEEP
12288:fWLKTDpoo482yNu+G6zDdMleAUw+PTRH/GKHdtEkajDYYHcMVR/eZBLlQ:ftTDio12yNu+G6CTwTROOdtEk
Static task
static1
Behavioral task
behavioral1
Sample
0063702f6d07cff9f160edab6793b7e8_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0063702f6d07cff9f160edab6793b7e8_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
webmail.active.by - Port:
587 - Username:
info@wimc.by - Password:
$!5&QOOFYN;5Fq
Targets
-
-
Target
0063702f6d07cff9f160edab6793b7e8_JaffaCakes118
-
Size
740KB
-
MD5
0063702f6d07cff9f160edab6793b7e8
-
SHA1
7eebdea0a348f84d235dcb420fb0f889495d0a66
-
SHA256
74af7154e682ceb0847587d3579e930b85b1a2543b281708c6530049047387fb
-
SHA512
793f94a507eea5a2f9aa1735c45382fd5fcc82acdf4f1cb4fd04e361609b21f5d63a2d159b5cbc70315074ef7f68680bd9a4b19ca3df6fde5ec0775128bd504d
-
SSDEEP
12288:fWLKTDpoo482yNu+G6zDdMleAUw+PTRH/GKHdtEkajDYYHcMVR/eZBLlQ:ftTDio12yNu+G6CTwTROOdtEk
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-