General
-
Target
b7b477366d557486a501cbd04b5c5a59_JaffaCakes118
-
Size
1.5MB
-
Sample
240617-kl956ashna
-
MD5
b7b477366d557486a501cbd04b5c5a59
-
SHA1
f661643b4601be89842ff1495ebba0bdb5123229
-
SHA256
c66c75df54d73d2c75ca91cc1a0d34def49b01e06d14abb39b89d04a84f40f64
-
SHA512
dfd687adab67549a022a1dfd7e202a29b303f4918dd2eb7316dd3f1b133a08351ae60208f3c7b76956c48911592bb97d996dcaf12394849964bb6a18373940ac
-
SSDEEP
24576:UHo4DzYyuGJVERwCFFq7TyO/BfexCLqDM+aPOc:ZL7GJVZCFF2TyO/BfdeQ1PF
Static task
static1
Behavioral task
behavioral1
Sample
b7b477366d557486a501cbd04b5c5a59_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b7b477366d557486a501cbd04b5c5a59_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
b7b477366d557486a501cbd04b5c5a59_JaffaCakes118
-
Size
1.5MB
-
MD5
b7b477366d557486a501cbd04b5c5a59
-
SHA1
f661643b4601be89842ff1495ebba0bdb5123229
-
SHA256
c66c75df54d73d2c75ca91cc1a0d34def49b01e06d14abb39b89d04a84f40f64
-
SHA512
dfd687adab67549a022a1dfd7e202a29b303f4918dd2eb7316dd3f1b133a08351ae60208f3c7b76956c48911592bb97d996dcaf12394849964bb6a18373940ac
-
SSDEEP
24576:UHo4DzYyuGJVERwCFFq7TyO/BfexCLqDM+aPOc:ZL7GJVZCFF2TyO/BfdeQ1PF
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-