General
-
Target
070332c654c8e742e979f5dfe1afb749_JaffaCakes118
-
Size
590KB
-
Sample
240429-g5s47sch2x
-
MD5
070332c654c8e742e979f5dfe1afb749
-
SHA1
3a516998955a09a3932d787fdde81dc0178c70dd
-
SHA256
25ef4e7f8043d39588e572eb3078e69ffab2ac871a5910170b7febbc0245e5c6
-
SHA512
23ca7a0b9e959609762ab27f96eeb00f01a8c647b576df47553bafcf13c254d9ed2b73847d826884eaf7892f755840a462f61f25ed9d1da11366ddd3b66fe4dc
-
SSDEEP
12288:C/HlgiqlYVUz+iS01Mwry8C1IjVzA9Dn6l+TGrlYNpcDap:yOnuYcDnG+TpN5
Static task
static1
Behavioral task
behavioral1
Sample
070332c654c8e742e979f5dfe1afb749_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
070332c654c8e742e979f5dfe1afb749_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
77.83.117.234 - Port:
587 - Username:
[email protected] - Password:
hP9aq4zW
Targets
-
-
Target
070332c654c8e742e979f5dfe1afb749_JaffaCakes118
-
Size
590KB
-
MD5
070332c654c8e742e979f5dfe1afb749
-
SHA1
3a516998955a09a3932d787fdde81dc0178c70dd
-
SHA256
25ef4e7f8043d39588e572eb3078e69ffab2ac871a5910170b7febbc0245e5c6
-
SHA512
23ca7a0b9e959609762ab27f96eeb00f01a8c647b576df47553bafcf13c254d9ed2b73847d826884eaf7892f755840a462f61f25ed9d1da11366ddd3b66fe4dc
-
SSDEEP
12288:C/HlgiqlYVUz+iS01Mwry8C1IjVzA9Dn6l+TGrlYNpcDap:yOnuYcDnG+TpN5
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-