General
-
Target
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118
-
Size
395KB
-
Sample
240523-2x6qjsce5z
-
MD5
6c8b4064ab664708e7723cb1aad27294
-
SHA1
2d525542f95fdc8a4a93793f5780101ae65ce5fa
-
SHA256
ee279c6b7a4debbd93a6aea65ad694d611fd54865a4af2afe304a284d13fa633
-
SHA512
57eabf864ebaa9b1265b23077c0b11c1b79a7f27e632ff8c755a153765423119526fc63077452bd452c4b9236668c8ce331b4fd96fb751e215e8e73939cd70a0
-
SSDEEP
6144:wJZj3XBjlkq27zgxR3pB/PtLwag4j1vkF5vaa2HjUSpu:4zZo7cv5BXdwafkFVaRH
Static task
static1
Behavioral task
behavioral1
Sample
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1160330796:AAF3SAwgW-OTi9M5kDhSZUlENwhKRvFOWe8/sendDocument
Targets
-
-
Target
6c8b4064ab664708e7723cb1aad27294_JaffaCakes118
-
Size
395KB
-
MD5
6c8b4064ab664708e7723cb1aad27294
-
SHA1
2d525542f95fdc8a4a93793f5780101ae65ce5fa
-
SHA256
ee279c6b7a4debbd93a6aea65ad694d611fd54865a4af2afe304a284d13fa633
-
SHA512
57eabf864ebaa9b1265b23077c0b11c1b79a7f27e632ff8c755a153765423119526fc63077452bd452c4b9236668c8ce331b4fd96fb751e215e8e73939cd70a0
-
SSDEEP
6144:wJZj3XBjlkq27zgxR3pB/PtLwag4j1vkF5vaa2HjUSpu:4zZo7cv5BXdwafkFVaRH
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-