General

  • Target

    6d41cc844cf15908d38212fcd0d27904_JaffaCakes118

  • Size

    281KB

  • Sample

    240524-ee9m6aca8x

  • MD5

    6d41cc844cf15908d38212fcd0d27904

  • SHA1

    430584e1740ac3e225f580b6a56772725191984e

  • SHA256

    597784234106601e18b0605f7339420a94e711fc6af3f40f7a8159f303756f74

  • SHA512

    47179c2a7702d57ad59ba4cc674a44aa4fe50cd3203a31dd6163d2476015c47a150fc2a0a9f8dcd57e774263e6e32a9cc8b78ee7f51945753d1bdecb9087237d

  • SSDEEP

    6144:CxK10O7J5nflboFFWgkM66Lyd86/IUPpbD:CxK32FAzMS

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.rianbowmax.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    QJLs)ui3

Targets

    • Target

      6d41cc844cf15908d38212fcd0d27904_JaffaCakes118

    • Size

      281KB

    • MD5

      6d41cc844cf15908d38212fcd0d27904

    • SHA1

      430584e1740ac3e225f580b6a56772725191984e

    • SHA256

      597784234106601e18b0605f7339420a94e711fc6af3f40f7a8159f303756f74

    • SHA512

      47179c2a7702d57ad59ba4cc674a44aa4fe50cd3203a31dd6163d2476015c47a150fc2a0a9f8dcd57e774263e6e32a9cc8b78ee7f51945753d1bdecb9087237d

    • SSDEEP

      6144:CxK10O7J5nflboFFWgkM66Lyd86/IUPpbD:CxK32FAzMS

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v15

Tasks