General
-
Target
a3ebdeb1cdb1799ec204e9f87ac051bf_JaffaCakes118
-
Size
481KB
-
Sample
240403-xkd3jshe9t
-
MD5
a3ebdeb1cdb1799ec204e9f87ac051bf
-
SHA1
8f51c5f8b4e4196bff4ebd07fb0416463ef2fd0d
-
SHA256
49b8d86772f28a310f9d6924d91b1d3bc7ec7d30026eab48a628e057f751037c
-
SHA512
80599a945d8fbffdc7094907401ef7407281930a0bde32c1e72124bfd5be87fd4fed96cab1b962752f0eac5ab4cab651cb7c1d1d441ef095340408cc94f28dcf
-
SSDEEP
6144:D6Uqd2GhNuN728LAiPnvodg8X1ONbDcXYi3U1n4s2ajTuQOE9pGRYMK6s7lr:WUi2iNuo80ovoX1IbDW3UZ4j0OE7GaV
Static task
static1
Behavioral task
behavioral1
Sample
a3ebdeb1cdb1799ec204e9f87ac051bf_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a3ebdeb1cdb1799ec204e9f87ac051bf_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.tccinfaes.com - Port:
587 - Username:
[email protected] - Password:
TccBps1427log - Email To:
[email protected]
Targets
-
-
Target
a3ebdeb1cdb1799ec204e9f87ac051bf_JaffaCakes118
-
Size
481KB
-
MD5
a3ebdeb1cdb1799ec204e9f87ac051bf
-
SHA1
8f51c5f8b4e4196bff4ebd07fb0416463ef2fd0d
-
SHA256
49b8d86772f28a310f9d6924d91b1d3bc7ec7d30026eab48a628e057f751037c
-
SHA512
80599a945d8fbffdc7094907401ef7407281930a0bde32c1e72124bfd5be87fd4fed96cab1b962752f0eac5ab4cab651cb7c1d1d441ef095340408cc94f28dcf
-
SSDEEP
6144:D6Uqd2GhNuN728LAiPnvodg8X1ONbDcXYi3U1n4s2ajTuQOE9pGRYMK6s7lr:WUi2iNuo80ovoX1IbDW3UZ4j0OE7GaV
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-