Overview

overview

10

Static

static

3

cd8b7c72ba...18.exe

windows7-x64

10

cd8b7c72ba...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd8b7c72ba0756f8e6477259d399b960_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240831-y99festfqe

  • MD5

    cd8b7c72ba0756f8e6477259d399b960

  • SHA1

    d3e9536cbe68699c134823f4730e9a388b403b3b

  • SHA256

    e50738bd86a1d753a2ccf0e88cfca85fb58986ce16cb9db779e3cbb45e9a4c07

  • SHA512

    0abb609b0d5d946ff7a1c884bc533cf764d92e706cca9438e10b45570af402b3e29defc70770b31a716b93676305fdec142cb0f15ac493a82d2cddaa544e5f46

  • SSDEEP

    24576:KyBLjP6+b1EyCGcZV/zerKsAEUVTa9hJz7H:rP1MT/SujEQTKD7H

Score
10/10
agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.prcpl.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    jyotika@2015

Targets

    • Target

      cd8b7c72ba0756f8e6477259d399b960_JaffaCakes118

    • Size

      1.1MB

    • MD5

      cd8b7c72ba0756f8e6477259d399b960

    • SHA1

      d3e9536cbe68699c134823f4730e9a388b403b3b

    • SHA256

      e50738bd86a1d753a2ccf0e88cfca85fb58986ce16cb9db779e3cbb45e9a4c07

    • SHA512

      0abb609b0d5d946ff7a1c884bc533cf764d92e706cca9438e10b45570af402b3e29defc70770b31a716b93676305fdec142cb0f15ac493a82d2cddaa544e5f46

    • SSDEEP

      24576:KyBLjP6+b1EyCGcZV/zerKsAEUVTa9hJz7H:rP1MT/SujEQTKD7H

    Score
    10/10
    agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Email Collection

1
T1114

Command and Control

Exfiltration

Impact

Tasks