General
-
Target
972854295049b24039db4c7bc00cd72f_JaffaCakes118
-
Size
677KB
-
Sample
240605-emesraee35
-
MD5
972854295049b24039db4c7bc00cd72f
-
SHA1
c8d36e9a6338e931c2ad047f91485e2eaeb9a911
-
SHA256
784c62915711702ebe7cfa5b9c7e3683d4d926d6b0636d3402e954fde1ee1f21
-
SHA512
43c59308dd53f34b1ff230aae1fd112b80fb787aef97be0784d42b22c804da8ff99e463ea3ea1f2b30144707f02c37aa5a0aa68c6ee3fd65698fa8684b7f20dd
-
SSDEEP
12288:gCDqF9XLi57sA+W6uTek5BsJpBIXQOgIr4gRVgS4tX92LhUU6e:S+siPZmpa9HvWXwLh5
Static task
static1
Behavioral task
behavioral1
Sample
972854295049b24039db4c7bc00cd72f_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
972854295049b24039db4c7bc00cd72f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1358407337:AAEn_F0epiFnfXDLwBqJY0mfwmNqFKhvO3I/sendDocument
Targets
-
-
Target
972854295049b24039db4c7bc00cd72f_JaffaCakes118
-
Size
677KB
-
MD5
972854295049b24039db4c7bc00cd72f
-
SHA1
c8d36e9a6338e931c2ad047f91485e2eaeb9a911
-
SHA256
784c62915711702ebe7cfa5b9c7e3683d4d926d6b0636d3402e954fde1ee1f21
-
SHA512
43c59308dd53f34b1ff230aae1fd112b80fb787aef97be0784d42b22c804da8ff99e463ea3ea1f2b30144707f02c37aa5a0aa68c6ee3fd65698fa8684b7f20dd
-
SSDEEP
12288:gCDqF9XLi57sA+W6uTek5BsJpBIXQOgIr4gRVgS4tX92LhUU6e:S+siPZmpa9HvWXwLh5
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-