General
-
Target
13a25c1e52852e21382ca1cf95d7f3f8_JaffaCakes118
-
Size
540KB
-
Sample
240329-alt4tsda82
-
MD5
13a25c1e52852e21382ca1cf95d7f3f8
-
SHA1
8b039ed91c8f30b93a0319ebb0bc4b0489c59dab
-
SHA256
be4ed533620683b3cee1b66140e24b3118c03fa2d076f705d7dc611fc31abc09
-
SHA512
4b584aedd0656042cd8250c6e3ba04e6cc0ba914f9c48456374d35dfe94694221c3cf5aaa8561338b5a1360a8a12696e222cb93256ed1002b0f3291862b39d68
-
SSDEEP
6144:uRsBdyp78rYipL6K98fAbSR+VvzO0/MLoS9nenGPO82oQzhDFCiENZRYOY9KH7Wn:VJUWL6nfAbx//MkSYnyOiE6ZbyISDyPW
Static task
static1
Behavioral task
behavioral1
Sample
QT2021154 NCX Glasurit Rev.1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
QT2021154 NCX Glasurit Rev.1.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.citechco.net - Port:
587 - Username:
anando@citechco.net - Password:
Webana@321#
Targets
-
-
Target
QT2021154 NCX Glasurit Rev.1.exe
-
Size
517KB
-
MD5
fbe7fb6fdb60cb39789826fcf0032b62
-
SHA1
5fb4a147e4ea8da5dcb68f205d7744468f05f89a
-
SHA256
80c73f11b33a9166d0dbd16257e47af68e966ee3dc41f0e5020fedd5c4c26f6a
-
SHA512
0b85e3e5e26ac32591cf8b2e17df8c72cc3114d820233af744bb498636331092579d0443518866206368d967b7b7f3b45956f050e18bceb6d8a5599df5a89e46
-
SSDEEP
12288:XBOi1kKAvRXphXp4SB8PpkpQNna0giIRZYOBe6o8GYApRBME2KpF:XBOrp1p1BycQNapZRZYznXMW
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Drops file in Drivers directory
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-