General
-
Target
f6eddc163cafa2bbc7d56dfd669678da_JaffaCakes118
-
Size
877KB
-
Sample
240418-a3tjmaee6z
-
MD5
f6eddc163cafa2bbc7d56dfd669678da
-
SHA1
a0b83d5aae1f5dfd5d30004761b266eb6d3d6cbe
-
SHA256
ca7c67238fb5574d7bf38ce673e13b7b7e5a7b1cfe834ce1571280e8f824b9e1
-
SHA512
ef2a9fb20807b3a6ca3f6ea4b1872befc6f979f55b759d96a7eb0426275a45cbedb87e171b09c8adca04540bc79587fb47eed9df2cf2332e160ae20a472924bf
-
SSDEEP
12288:AwtUbbaAQwLPlytYEbUwKKF/0Mo/Bc38kGKd+ID9AdnKUBm7HB8Q6+PG35VH7mo2:7tUbblTWVrKfpcsZGFk7mo5oFCEkv
Static task
static1
Behavioral task
behavioral1
Sample
f6eddc163cafa2bbc7d56dfd669678da_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f6eddc163cafa2bbc7d56dfd669678da_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.qwerrrty.us - Port:
587 - Username:
[email protected] - Password:
4p(N#wZ]=7T98Hu)
Targets
-
-
Target
f6eddc163cafa2bbc7d56dfd669678da_JaffaCakes118
-
Size
877KB
-
MD5
f6eddc163cafa2bbc7d56dfd669678da
-
SHA1
a0b83d5aae1f5dfd5d30004761b266eb6d3d6cbe
-
SHA256
ca7c67238fb5574d7bf38ce673e13b7b7e5a7b1cfe834ce1571280e8f824b9e1
-
SHA512
ef2a9fb20807b3a6ca3f6ea4b1872befc6f979f55b759d96a7eb0426275a45cbedb87e171b09c8adca04540bc79587fb47eed9df2cf2332e160ae20a472924bf
-
SSDEEP
12288:AwtUbbaAQwLPlytYEbUwKKF/0Mo/Bc38kGKd+ID9AdnKUBm7HB8Q6+PG35VH7mo2:7tUbblTWVrKfpcsZGFk7mo5oFCEkv
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1