General

  • Target

    07235191bc4a2cb3bd75667ddaf43950_JaffaCakes118

  • Size

    607KB

  • Sample

    240328-q39tlsgf94

  • MD5

    07235191bc4a2cb3bd75667ddaf43950

  • SHA1

    2068b25e2b28889e26395be0c401b6f8c7838cd0

  • SHA256

    0e3e6413a4c2f3666b7ffa43b3b1b13f470875f410a13c0ec6bbd2ddae3bd8cf

  • SHA512

    ffaa3651b51301faa0c782ad80470ba99e80db154a19cdfae4965bb5705896a1109511337c0508898381357731f6cf664026e6d40a8ba4e913259f2ce1bcd8e7

  • SSDEEP

    12288:WhvUUWYU6PqKnGR3nEWlf0nRHqnlqw3h/MtLyb0:OMUWYU753ZgBYqwR/Mpyb

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    emeka@generalbravo.com
  • Password:
    e)cnIdR1

Targets

    • Target

      07235191bc4a2cb3bd75667ddaf43950_JaffaCakes118

    • Size

      607KB

    • MD5

      07235191bc4a2cb3bd75667ddaf43950

    • SHA1

      2068b25e2b28889e26395be0c401b6f8c7838cd0

    • SHA256

      0e3e6413a4c2f3666b7ffa43b3b1b13f470875f410a13c0ec6bbd2ddae3bd8cf

    • SHA512

      ffaa3651b51301faa0c782ad80470ba99e80db154a19cdfae4965bb5705896a1109511337c0508898381357731f6cf664026e6d40a8ba4e913259f2ce1bcd8e7

    • SSDEEP

      12288:WhvUUWYU6PqKnGR3nEWlf0nRHqnlqw3h/MtLyb0:OMUWYU753ZgBYqwR/Mpyb

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks