General
-
Target
026f12fdb0bf9f20686cad99cc2a1d7c_JaffaCakes118
-
Size
502KB
-
Sample
240328-lrlkeshg21
-
MD5
026f12fdb0bf9f20686cad99cc2a1d7c
-
SHA1
c438090380e7df245b7ce241e3182236b7f48ef6
-
SHA256
277bdc8ef28c316c3dbff5d656e2fa1ff2d25018e2bc4ebbdbc8bd60a1e3ede7
-
SHA512
2ac6b9e419462749f4eed4b320e3f23c06fd6fed39885e401f0a3987061c90ccca431cdf4aff535564aa376cea6cc104ce4df80f16faa240d9397f8f9de12011
-
SSDEEP
12288:OwmWkYkC4dAwgHsgN9RyEYT63B4xlrWPst+X:OtW9ktDgHsgN9RyJT+4TrWkM
Static task
static1
Behavioral task
behavioral1
Sample
70654 SSEBACT.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
70654 SSEBACT.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.timsonlogisticske.com - Port:
587 - Username:
info@timsonlogisticske.com - Password:
timsam2015
Targets
-
-
Target
70654 SSEBACT.exe
-
Size
389KB
-
MD5
54ad9166b1a65288183c4ee3a5fd0750
-
SHA1
36fad28b8c9b45a7b90c3f2fd4e5785b859e48ae
-
SHA256
faaa464df297e2bda628f86354e76da115e88941ec92386302a6cac74fecfca0
-
SHA512
3b9a58297ac116f94e8728a660cbb963c00722acb3c202ad23f7133eac2368bdbf665c32a1fa10b6f122dd5058113f54ed64fbfdfc1be66f7a701453aef59eba
-
SSDEEP
12288:tjlvy1zJ2WI3v+s41pAmvZxJXwM9ZaoxU8U:twZTIWs4ZpwMzlxU8U
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-