General
-
Target
21c8c9b4fe3f3a655171bc51cd34e345_JaffaCakes118
-
Size
622KB
-
Sample
240329-pgzk3shc35
-
MD5
21c8c9b4fe3f3a655171bc51cd34e345
-
SHA1
f1b9455e307b275cd553ad284180b4b60c5890cf
-
SHA256
8c537b5f1e4e157c1fe2ddccbacf3630ab4e51608382efe6d4bb44bcaea8a11b
-
SHA512
820f4c44a2f4597acd29c6218ac491246a4ebe04961b3dc09ea205408691ae711f01a6b2c51a85f2c9696de191121bd493c2e3c3975f3e3c3328b7226b105327
-
SSDEEP
6144:8/d6MFohvg6B6UqrlHmbqPuAwfa29jssRBsme+j8sHgb+IW8WuBfSu2/+y+h9XXt:jhvCUrMEfaUjG8j8LnWuBP2q/bu10
Static task
static1
Behavioral task
behavioral1
Sample
21c8c9b4fe3f3a655171bc51cd34e345_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
21c8c9b4fe3f3a655171bc51cd34e345_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.idaksu.com - Port:
587 - Username:
[email protected] - Password:
berlina3838
Targets
-
-
Target
21c8c9b4fe3f3a655171bc51cd34e345_JaffaCakes118
-
Size
622KB
-
MD5
21c8c9b4fe3f3a655171bc51cd34e345
-
SHA1
f1b9455e307b275cd553ad284180b4b60c5890cf
-
SHA256
8c537b5f1e4e157c1fe2ddccbacf3630ab4e51608382efe6d4bb44bcaea8a11b
-
SHA512
820f4c44a2f4597acd29c6218ac491246a4ebe04961b3dc09ea205408691ae711f01a6b2c51a85f2c9696de191121bd493c2e3c3975f3e3c3328b7226b105327
-
SSDEEP
6144:8/d6MFohvg6B6UqrlHmbqPuAwfa29jssRBsme+j8sHgb+IW8WuBfSu2/+y+h9XXt:jhvCUrMEfaUjG8j8LnWuBP2q/bu10
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-