General
-
Target
78239abe859d450a77030e78ee3b96e6_JaffaCakes118
-
Size
1.9MB
-
Sample
240527-grfa7abc68
-
MD5
78239abe859d450a77030e78ee3b96e6
-
SHA1
cd2386e1aa561c541a24c8a2cac07fd7ffb58c81
-
SHA256
79f647804ab897989d5eedddb7b9dc22ceee08353bd81d6132c72917e6ee2b1a
-
SHA512
406455c6209ed34702e1ed3a0d822c14d92689a083bce8eb359c6de3736a72cad2d438dfde61112a81537d361d02843f33125b0a1a3c43b1c99bb723a329fd25
-
SSDEEP
49152:1Vg5tQ7aVeudjcAEer3j6AvPMN6nJkCHl7Q5:7g56KdYAWAsN6nbZ
Static task
static1
Behavioral task
behavioral1
Sample
78239abe859d450a77030e78ee3b96e6_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
78239abe859d450a77030e78ee3b96e6_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
HOFUF@5969
Extracted
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
HOFUF@5969
Targets
-
-
Target
78239abe859d450a77030e78ee3b96e6_JaffaCakes118
-
Size
1.9MB
-
MD5
78239abe859d450a77030e78ee3b96e6
-
SHA1
cd2386e1aa561c541a24c8a2cac07fd7ffb58c81
-
SHA256
79f647804ab897989d5eedddb7b9dc22ceee08353bd81d6132c72917e6ee2b1a
-
SHA512
406455c6209ed34702e1ed3a0d822c14d92689a083bce8eb359c6de3736a72cad2d438dfde61112a81537d361d02843f33125b0a1a3c43b1c99bb723a329fd25
-
SSDEEP
49152:1Vg5tQ7aVeudjcAEer3j6AvPMN6nJkCHl7Q5:7g56KdYAWAsN6nbZ
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-