General
-
Target
69badeba72e3fff74200158daf17c616_JaffaCakes118
-
Size
374KB
-
Sample
240523-e5wtzsea34
-
MD5
69badeba72e3fff74200158daf17c616
-
SHA1
800375689cef87a42477b5cf02a00dcd908f4839
-
SHA256
f4e60792b136f02c28fd35322ee58bf723aeaa3611d286417d8b2b0707612cdc
-
SHA512
83e920fe42853baf9754dae12b70aaa47443ccab3dd293fc1995ef8fbe83ed53c8d2f8396b456f788760209852f7221f7516f1161261dd7afe6a078c82a65cd2
-
SSDEEP
6144:JXTcH1fu9uKdgSZvy4raeXjuMkqryNPs0tioqn9onD4EpvL:JD4fqRBdy4r3XyMb6U0tix9onD4Eh
Static task
static1
Behavioral task
behavioral1
Sample
69badeba72e3fff74200158daf17c616_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
69badeba72e3fff74200158daf17c616_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.1and1.es - Port:
587 - Username:
[email protected] - Password:
elsecreto2019
Targets
-
-
Target
69badeba72e3fff74200158daf17c616_JaffaCakes118
-
Size
374KB
-
MD5
69badeba72e3fff74200158daf17c616
-
SHA1
800375689cef87a42477b5cf02a00dcd908f4839
-
SHA256
f4e60792b136f02c28fd35322ee58bf723aeaa3611d286417d8b2b0707612cdc
-
SHA512
83e920fe42853baf9754dae12b70aaa47443ccab3dd293fc1995ef8fbe83ed53c8d2f8396b456f788760209852f7221f7516f1161261dd7afe6a078c82a65cd2
-
SSDEEP
6144:JXTcH1fu9uKdgSZvy4raeXjuMkqryNPs0tioqn9onD4EpvL:JD4fqRBdy4r3XyMb6U0tix9onD4Eh
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-