General
-
Target
0c66d5af0dd882d40ce05e8121fdb0b5_JaffaCakes118
-
Size
521KB
-
Sample
240328-wnb7padd46
-
MD5
0c66d5af0dd882d40ce05e8121fdb0b5
-
SHA1
90e04aa144c697ab29a646546b2575bc304070f7
-
SHA256
c58580b14cb6255d0d21086e02557b7ab1ebcfb742fe732225a36766cc10893d
-
SHA512
9131476bbdff49832a2b114332c94afca44a322e110695473e775460f427d49e769a620fb0acca6044d8d62b48a2dffd4c53698b6e0be379eb4c8a63bcd3ff09
-
SSDEEP
12288:LFTAvRXphXpWSBh5Cimq2KF9PXpdumo/YfhyrHrb:up1pLBh5uq2KHP5wRMMHr
Static task
static1
Behavioral task
behavioral1
Sample
0c66d5af0dd882d40ce05e8121fdb0b5_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0c66d5af0dd882d40ce05e8121fdb0b5_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.medicare-equipment.com - Port:
587 - Username:
medicare@medicare-equipment.com - Password:
AllTheBest777 - Email To:
royjerry59125@yandex.com
Targets
-
-
Target
0c66d5af0dd882d40ce05e8121fdb0b5_JaffaCakes118
-
Size
521KB
-
MD5
0c66d5af0dd882d40ce05e8121fdb0b5
-
SHA1
90e04aa144c697ab29a646546b2575bc304070f7
-
SHA256
c58580b14cb6255d0d21086e02557b7ab1ebcfb742fe732225a36766cc10893d
-
SHA512
9131476bbdff49832a2b114332c94afca44a322e110695473e775460f427d49e769a620fb0acca6044d8d62b48a2dffd4c53698b6e0be379eb4c8a63bcd3ff09
-
SSDEEP
12288:LFTAvRXphXpWSBh5Cimq2KF9PXpdumo/YfhyrHrb:up1pLBh5uq2KHP5wRMMHr
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-