General

  • Target

    f9f0c253c5fb23f5e38ead5d85bd93ed_JaffaCakes118

  • Size

    1.4MB

  • Sample

    240419-kqcqfsdb72

  • MD5

    f9f0c253c5fb23f5e38ead5d85bd93ed

  • SHA1

    8f47664c51fdb281ae53bb1832b080ffdeabe06f

  • SHA256

    bbb0d4b90eca36459007965aa8c1609105775769fc73c7eb8f54a7829017297f

  • SHA512

    3040cde654a90c7771b2600110c11db6ba823c01385932ed5b262317b5ed699d6ec312d713a76226c15173833748389cd584d4e0addb8746c56fe38c416fe64c

  • SSDEEP

    24576:J7QCTfNcRfx8DgMfx8Dgoiv/nwyKqTcxfQ9REiscZCSLL:FfCR58DgM58DgcyKqmfQwOZC2

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.3aglobalengg.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    admin@2022

Targets

    • Target

      f9f0c253c5fb23f5e38ead5d85bd93ed_JaffaCakes118

    • Size

      1.4MB

    • MD5

      f9f0c253c5fb23f5e38ead5d85bd93ed

    • SHA1

      8f47664c51fdb281ae53bb1832b080ffdeabe06f

    • SHA256

      bbb0d4b90eca36459007965aa8c1609105775769fc73c7eb8f54a7829017297f

    • SHA512

      3040cde654a90c7771b2600110c11db6ba823c01385932ed5b262317b5ed699d6ec312d713a76226c15173833748389cd584d4e0addb8746c56fe38c416fe64c

    • SSDEEP

      24576:J7QCTfNcRfx8DgMfx8Dgoiv/nwyKqTcxfQ9REiscZCSLL:FfCR58DgM58DgcyKqmfQwOZC2

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks