General
-
Target
17c013ef54d77f3a21dba1015a5d0a6d_JaffaCakes118
-
Size
473KB
-
Sample
240329-ehkhfahb81
-
MD5
17c013ef54d77f3a21dba1015a5d0a6d
-
SHA1
2e03a063dacf2ab5da74fc804420be20ec539235
-
SHA256
2cdb5e01ac073690d5c4a3ed3ba53eca94dbb701c7811f088a89b8ca9a6e2670
-
SHA512
ca294feb4050751537a4f0822b40ffd4d03206aa7bdc5bbd43a958d962dcd93695fbb5f9a9226d9cbf4649952deed3eb36cb90596fc507160827c7ec95fe65af
-
SSDEEP
12288:GGEw3uCozebqH5fB3ZnySrVGm6eLu3NCG66xqs6K9PZa:GGpLoqa9nySrVZ6eLuvx6N
Static task
static1
Behavioral task
behavioral1
Sample
17c013ef54d77f3a21dba1015a5d0a6d_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
17c013ef54d77f3a21dba1015a5d0a6d_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
mmm777
Targets
-
-
Target
17c013ef54d77f3a21dba1015a5d0a6d_JaffaCakes118
-
Size
473KB
-
MD5
17c013ef54d77f3a21dba1015a5d0a6d
-
SHA1
2e03a063dacf2ab5da74fc804420be20ec539235
-
SHA256
2cdb5e01ac073690d5c4a3ed3ba53eca94dbb701c7811f088a89b8ca9a6e2670
-
SHA512
ca294feb4050751537a4f0822b40ffd4d03206aa7bdc5bbd43a958d962dcd93695fbb5f9a9226d9cbf4649952deed3eb36cb90596fc507160827c7ec95fe65af
-
SSDEEP
12288:GGEw3uCozebqH5fB3ZnySrVGm6eLu3NCG66xqs6K9PZa:GGpLoqa9nySrVZ6eLuvx6N
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-