General
-
Target
000b20cafe3744650b7247750d511876_JaffaCakes118
-
Size
532KB
-
Sample
240328-hs1tyscg29
-
MD5
000b20cafe3744650b7247750d511876
-
SHA1
08204bead740b34c4628daf7888ac0a10db4d146
-
SHA256
de54f743f7013404a6b143790034fbdc9636f75dfb1d914c6c3176ade71d0e61
-
SHA512
5669912fa0e06a2e1a34466973e3e6028a83cf0ea7fe64fb5cd79878cb3a2cae01533acdd31d17051bd0baa739804c0af1bd57b0e78367863227155fc50f2f45
-
SSDEEP
12288:U6GEEyLdRgd1pmAkw2TySu7v6rnq+8+qKNI9:UadRqYH1u7ij98+I
Static task
static1
Behavioral task
behavioral1
Sample
000b20cafe3744650b7247750d511876_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
000b20cafe3744650b7247750d511876_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
uscentral50.myserverhosts.com - Port:
587 - Username:
sales@radheatwaters.com - Password:
waters@789
Targets
-
-
Target
000b20cafe3744650b7247750d511876_JaffaCakes118
-
Size
532KB
-
MD5
000b20cafe3744650b7247750d511876
-
SHA1
08204bead740b34c4628daf7888ac0a10db4d146
-
SHA256
de54f743f7013404a6b143790034fbdc9636f75dfb1d914c6c3176ade71d0e61
-
SHA512
5669912fa0e06a2e1a34466973e3e6028a83cf0ea7fe64fb5cd79878cb3a2cae01533acdd31d17051bd0baa739804c0af1bd57b0e78367863227155fc50f2f45
-
SSDEEP
12288:U6GEEyLdRgd1pmAkw2TySu7v6rnq+8+qKNI9:UadRqYH1u7ij98+I
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-