General
-
Target
bd22675ea6345d64312eb23cdd8632c9_JaffaCakes118
-
Size
579KB
-
Sample
240618-v3xw9sshqb
-
MD5
bd22675ea6345d64312eb23cdd8632c9
-
SHA1
9d30be40b1e0c80a9cc46e2c424613f059b8457f
-
SHA256
0618ed9ebed756ca8dbaa7270347f5374932bc8a4b938d4870c8ab56465525c6
-
SHA512
10c068b5b842eb802d3c6a0c1995998bc2651a024c91923e45a55971550f7b04c67828692accca2acf6dff304ffb266ba69b23a2adb83b5ceb82ccb48848dbc3
-
SSDEEP
12288:43dyFigUl2B0Lzg9Ud4HTk0UkVkoQygWgcyw3cvtZM9J5:AdySl2BqzkUK9WoQygLXtZCJ5
Static task
static1
Behavioral task
behavioral1
Sample
BANK DETAILS.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
BANK DETAILS.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
faith12AB
Targets
-
-
Target
BANK DETAILS.exe
-
Size
637KB
-
MD5
40d0bcab4d57a4194938744ed5d22c51
-
SHA1
2700d2ae373bcde93e9636f75547936326577110
-
SHA256
9bac0e273d5e86b4be40e949d0256c1f8fc3fd65559a55524c88797b7ba0194d
-
SHA512
a13d3af75132cc46b33490f32a515a5e149930c61950f9d2b4d0a2fbe646149506e9bf7fdcefbe8a78de4ea3a80229794803527878b3e9f8565606dc30cc90a1
-
SSDEEP
12288:sjMgUD2J0LzgzAPKHxksUefkoQCgWgQ0w3c1ca:LD2Jqz8AS1ooQCgL9ca
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-