General
-
Target
fa1cf337d1d5acc084248b115f985984_JaffaCakes118
-
Size
1.2MB
-
Sample
240419-ml5lsahf5w
-
MD5
fa1cf337d1d5acc084248b115f985984
-
SHA1
31e946e66637e1471b3a1f1f167abbea960f8bf2
-
SHA256
7d65371ce1f6ca3aae8d83206cc3484b54722f3993e94a2339482a02b3d94be7
-
SHA512
d604cd2506141a4556a056498e82bcf19f5180bacb3df40df10888488093a750aaebfddf1550c306526ae991ec2cceca384af75282cd8b059bcc8275f3ea84a0
-
SSDEEP
24576:4kOsBgo0q4wMvBmCmTOUd+L6kWXWHe7wfbK:4NoHMZmCm6Ud+zWXQ
Static task
static1
Behavioral task
behavioral1
Sample
fa1cf337d1d5acc084248b115f985984_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fa1cf337d1d5acc084248b115f985984_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.scriptcopy.org - Port:
587 - Username:
[email protected] - Password:
t%K@flX5~T45 - Email To:
[email protected]
Targets
-
-
Target
fa1cf337d1d5acc084248b115f985984_JaffaCakes118
-
Size
1.2MB
-
MD5
fa1cf337d1d5acc084248b115f985984
-
SHA1
31e946e66637e1471b3a1f1f167abbea960f8bf2
-
SHA256
7d65371ce1f6ca3aae8d83206cc3484b54722f3993e94a2339482a02b3d94be7
-
SHA512
d604cd2506141a4556a056498e82bcf19f5180bacb3df40df10888488093a750aaebfddf1550c306526ae991ec2cceca384af75282cd8b059bcc8275f3ea84a0
-
SSDEEP
24576:4kOsBgo0q4wMvBmCmTOUd+L6kWXWHe7wfbK:4NoHMZmCm6Ud+zWXQ
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-