General
-
Target
de62a5dab135dba7f992aa357d7a5ce2_JaffaCakes118
-
Size
914KB
-
Sample
240913-rqlrpathmc
-
MD5
de62a5dab135dba7f992aa357d7a5ce2
-
SHA1
a8070428eca816b47d177396c3b579ed5d30bfcc
-
SHA256
d18b49a5a492666909ad1d1d9f17b538d4c7da9c804fd5f694170ba46a05c708
-
SHA512
bae7a247863179b0ef0b2c6d8e3431867c7fb769d95c64765ac24cb4ad8429bc521407b27ba721333cad870c4e3ce87a7f3b6a400b4d18ea380c0f4636ce5e9c
-
SSDEEP
12288:khZ6bbOq+4Lz0Y7aGlDdJ2iFVdZtXKZ6bbOq+4Lz0Y7aGlDdJ2iFVdZtXdkO:WZJ40sxlDz2ILZgZJ40sxlDz2ILZgO
Static task
static1
Behavioral task
behavioral1
Sample
de62a5dab135dba7f992aa357d7a5ce2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
de62a5dab135dba7f992aa357d7a5ce2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.gayaceramic.com - Port:
587 - Username:
[email protected] - Password:
2019gaya - Email To:
[email protected]
Targets
-
-
Target
de62a5dab135dba7f992aa357d7a5ce2_JaffaCakes118
-
Size
914KB
-
MD5
de62a5dab135dba7f992aa357d7a5ce2
-
SHA1
a8070428eca816b47d177396c3b579ed5d30bfcc
-
SHA256
d18b49a5a492666909ad1d1d9f17b538d4c7da9c804fd5f694170ba46a05c708
-
SHA512
bae7a247863179b0ef0b2c6d8e3431867c7fb769d95c64765ac24cb4ad8429bc521407b27ba721333cad870c4e3ce87a7f3b6a400b4d18ea380c0f4636ce5e9c
-
SSDEEP
12288:khZ6bbOq+4Lz0Y7aGlDdJ2iFVdZtXKZ6bbOq+4Lz0Y7aGlDdJ2iFVdZtXdkO:WZJ40sxlDz2ILZgZJ40sxlDz2ILZgO
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1