General

  • Target

    d4104f8f71df1639d38987bb2e2faac1_JaffaCakes118

  • Size

    698KB

  • Sample

    240908-ln16psyejq

  • MD5

    d4104f8f71df1639d38987bb2e2faac1

  • SHA1

    8d9d39087621a69814ce9073e0de0dea0f818951

  • SHA256

    e458cdccbc2d7aa7378c2f9113183ceec0a1ce1ee057cef817ab748c12265f34

  • SHA512

    3f32f3cbd71add2a3dd4034769a55f9157ecf7724cc99d936961dd7e4385d47206f6fdb4bb5d2d5b391ccc8bc32cb6a8992fa93d5ba80e39c990b90f65e3c73b

  • SSDEEP

    12288:VBl8M3xpw1WYDo3hNSeJczWm/EyEowLYJNTzteGzyKxy1PeNw0xqtt:t8Gp+WVxkeJpm/zwLUDy16yt

Malware Config

Targets

    • Target

      d4104f8f71df1639d38987bb2e2faac1_JaffaCakes118

    • Size

      698KB

    • MD5

      d4104f8f71df1639d38987bb2e2faac1

    • SHA1

      8d9d39087621a69814ce9073e0de0dea0f818951

    • SHA256

      e458cdccbc2d7aa7378c2f9113183ceec0a1ce1ee057cef817ab748c12265f34

    • SHA512

      3f32f3cbd71add2a3dd4034769a55f9157ecf7724cc99d936961dd7e4385d47206f6fdb4bb5d2d5b391ccc8bc32cb6a8992fa93d5ba80e39c990b90f65e3c73b

    • SSDEEP

      12288:VBl8M3xpw1WYDo3hNSeJczWm/EyEowLYJNTzteGzyKxy1PeNw0xqtt:t8Gp+WVxkeJpm/zwLUDy16yt

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Disables Task Manager via registry modification

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks