General
-
Target
0a151230d2b5766a3dc778c2dd4c0895_JaffaCakes118
-
Size
561KB
-
Sample
240430-s2rmraab31
-
MD5
0a151230d2b5766a3dc778c2dd4c0895
-
SHA1
490dfddccfe1b8ec30e571949c02b8a05ebb44c8
-
SHA256
30fdec40461cec47e87e53025ee73ae26a4f128c8bb2f81e3915b010a8a1b6f4
-
SHA512
f64a5506ff214fb5b8cb26288d3ab0484980c5df7e21ee9c96519d2bfd15c36b99f8b41ef59607e119122e002d1b3b0763a05a79f87bffac9953553176485497
-
SSDEEP
6144:/sGf4nL24vAlcciSVz6QGKuAzxEzDla7PN8tW1qzfIO3wz0Co3sLuwhOA:/sXL24dcb2941X7F8tTW
Static task
static1
Behavioral task
behavioral1
Sample
0a151230d2b5766a3dc778c2dd4c0895_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0a151230d2b5766a3dc778c2dd4c0895_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Malware Config
Targets
-
-
Target
0a151230d2b5766a3dc778c2dd4c0895_JaffaCakes118
-
Size
561KB
-
MD5
0a151230d2b5766a3dc778c2dd4c0895
-
SHA1
490dfddccfe1b8ec30e571949c02b8a05ebb44c8
-
SHA256
30fdec40461cec47e87e53025ee73ae26a4f128c8bb2f81e3915b010a8a1b6f4
-
SHA512
f64a5506ff214fb5b8cb26288d3ab0484980c5df7e21ee9c96519d2bfd15c36b99f8b41ef59607e119122e002d1b3b0763a05a79f87bffac9953553176485497
-
SSDEEP
6144:/sGf4nL24vAlcciSVz6QGKuAzxEzDla7PN8tW1qzfIO3wz0Co3sLuwhOA:/sXL24dcb2941X7F8tTW
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-