General
-
Target
de848d7a8fc498435755e7fd5bc0fc63_JaffaCakes118
-
Size
594KB
-
Sample
240913-vev3rsybkh
-
MD5
de848d7a8fc498435755e7fd5bc0fc63
-
SHA1
53e34f932a122265ea44b51449599d4417c18d64
-
SHA256
54bf3d43081df1fe54973306d62bfe19fb27278c2248431095d1e953870dd09b
-
SHA512
bce48b926aecee76874f5d9f720b563f643f74af0ba8e0d6408092dbb0bc42e31cfd775a625652b1b701ac149ae056da0bdaaef57f726a034e98e37a67b9c5f6
-
SSDEEP
12288:8hATkOSjH7RS4p68WQyViGgaID4wBvRQao:aCS44dNyVitNvRQ
Static task
static1
Behavioral task
behavioral1
Sample
de848d7a8fc498435755e7fd5bc0fc63_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
de848d7a8fc498435755e7fd5bc0fc63_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
78.142.19.101 - Port:
587 - Username:
[email protected] - Password:
8txksCN56
Targets
-
-
Target
de848d7a8fc498435755e7fd5bc0fc63_JaffaCakes118
-
Size
594KB
-
MD5
de848d7a8fc498435755e7fd5bc0fc63
-
SHA1
53e34f932a122265ea44b51449599d4417c18d64
-
SHA256
54bf3d43081df1fe54973306d62bfe19fb27278c2248431095d1e953870dd09b
-
SHA512
bce48b926aecee76874f5d9f720b563f643f74af0ba8e0d6408092dbb0bc42e31cfd775a625652b1b701ac149ae056da0bdaaef57f726a034e98e37a67b9c5f6
-
SSDEEP
12288:8hATkOSjH7RS4p68WQyViGgaID4wBvRQao:aCS44dNyVitNvRQ
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-