General
-
Target
1c83d78c1969a7ebc3deaa1990c9dc9e_JaffaCakes118
-
Size
723KB
-
Sample
240329-jkhh3sce9w
-
MD5
1c83d78c1969a7ebc3deaa1990c9dc9e
-
SHA1
2918dc3b764c8c60d0fb64f8bc54bf4f92ba1f0f
-
SHA256
c39785b91858501d961c57f85b4c28fc6e674fc68f40244ecbc649870fa749ad
-
SHA512
9250a4adf4f43ba422988acbf8447133890b0cbfb650e2ac3e9d7a4a5892c0c2bb61801a156450440c20f1017b68d7a2aca907e15372fc631d983eb59d7d4b4b
-
SSDEEP
12288:QoQEWqEtJPwMSrmNeJgfV3jPzt9eZaxFrPUuN+JQVU:FhEtJPFSr32fV3dAcx1PUuNfU
Static task
static1
Behavioral task
behavioral1
Sample
1c83d78c1969a7ebc3deaa1990c9dc9e_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1c83d78c1969a7ebc3deaa1990c9dc9e_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.vivaldi.net - Port:
587 - Username:
[email protected] - Password:
K@maR1-2019Hotelss
Targets
-
-
Target
1c83d78c1969a7ebc3deaa1990c9dc9e_JaffaCakes118
-
Size
723KB
-
MD5
1c83d78c1969a7ebc3deaa1990c9dc9e
-
SHA1
2918dc3b764c8c60d0fb64f8bc54bf4f92ba1f0f
-
SHA256
c39785b91858501d961c57f85b4c28fc6e674fc68f40244ecbc649870fa749ad
-
SHA512
9250a4adf4f43ba422988acbf8447133890b0cbfb650e2ac3e9d7a4a5892c0c2bb61801a156450440c20f1017b68d7a2aca907e15372fc631d983eb59d7d4b4b
-
SSDEEP
12288:QoQEWqEtJPwMSrmNeJgfV3jPzt9eZaxFrPUuN+JQVU:FhEtJPFSr32fV3dAcx1PUuNfU
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-