General
-
Target
754a8b8acc8efc131c31a8699e436d6c_JaffaCakes118
-
Size
651KB
-
Sample
240726-xjw7qs1dre
-
MD5
754a8b8acc8efc131c31a8699e436d6c
-
SHA1
e4d07113f756a089fee512fa26a6efcd99ce6669
-
SHA256
78df5c6c397c0473e00359d54b51d87082a900525bcc70d914ebb07890d551e1
-
SHA512
9b5e5bc8753434f931760089ce7f8104a41c2c6be5917c90138fd022a297284d82c48a0b6a1de31808d4a6c92e3964fe9b7ff2d7c9488063fa68214dac443136
-
SSDEEP
12288:u86YTC4M0LTewi5DMzK14sFfgVcnQxBzLZE0QEVFMWM:u86oB4uK2q9QDL6I7F
Static task
static1
Behavioral task
behavioral1
Sample
754a8b8acc8efc131c31a8699e436d6c_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
754a8b8acc8efc131c31a8699e436d6c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
@damienzy.xyz2240
Extracted
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
@damienzy.xyz2240
Targets
-
-
Target
754a8b8acc8efc131c31a8699e436d6c_JaffaCakes118
-
Size
651KB
-
MD5
754a8b8acc8efc131c31a8699e436d6c
-
SHA1
e4d07113f756a089fee512fa26a6efcd99ce6669
-
SHA256
78df5c6c397c0473e00359d54b51d87082a900525bcc70d914ebb07890d551e1
-
SHA512
9b5e5bc8753434f931760089ce7f8104a41c2c6be5917c90138fd022a297284d82c48a0b6a1de31808d4a6c92e3964fe9b7ff2d7c9488063fa68214dac443136
-
SSDEEP
12288:u86YTC4M0LTewi5DMzK14sFfgVcnQxBzLZE0QEVFMWM:u86oB4uK2q9QDL6I7F
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-