General
-
Target
fa9926f2ad9b2b86e51a845b381354bf_JaffaCakes118
-
Size
1.2MB
-
Sample
240419-svdsbagf71
-
MD5
fa9926f2ad9b2b86e51a845b381354bf
-
SHA1
c57795a1bd06f88cf7f4d4b1b4c8b2fa62fce6ee
-
SHA256
7258624b4f13f9c724040e9bc0f6326c2e8add1e06226d78cd833eda3e3c7915
-
SHA512
1fbdc8b92d661af98a83d68760e65cf256b42d5beaf8774b3aaf7fca81696538db6f7e24b8e5e61d11563140acce685b234e24a241e31be79e0bc9de7ec79b23
-
SSDEEP
24576:YcS/d3xKzksMkscOFdyKx7YrwANaQVG0y8jhMN6ZNwZ:sKOxkNNah0yN6ZNw
Static task
static1
Behavioral task
behavioral1
Sample
fa9926f2ad9b2b86e51a845b381354bf_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
fa9926f2ad9b2b86e51a845b381354bf_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
john2020
Targets
-
-
Target
fa9926f2ad9b2b86e51a845b381354bf_JaffaCakes118
-
Size
1.2MB
-
MD5
fa9926f2ad9b2b86e51a845b381354bf
-
SHA1
c57795a1bd06f88cf7f4d4b1b4c8b2fa62fce6ee
-
SHA256
7258624b4f13f9c724040e9bc0f6326c2e8add1e06226d78cd833eda3e3c7915
-
SHA512
1fbdc8b92d661af98a83d68760e65cf256b42d5beaf8774b3aaf7fca81696538db6f7e24b8e5e61d11563140acce685b234e24a241e31be79e0bc9de7ec79b23
-
SSDEEP
24576:YcS/d3xKzksMkscOFdyKx7YrwANaQVG0y8jhMN6ZNwZ:sKOxkNNah0yN6ZNw
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-