Resubmissions

14-09-2024 13:40

240914-qyh54awgjq 10

14-09-2024 13:34

240914-qvecqswepq 10

General

  • Target

    e049bf2e95cfd9354cd04da57dc33e0d_JaffaCakes118

  • Size

    345KB

  • Sample

    240914-qyh54awgjq

  • MD5

    e049bf2e95cfd9354cd04da57dc33e0d

  • SHA1

    e5b896193a4bcfd10723dd914e2f19fd693df9b3

  • SHA256

    2122beff06c9c868008da7f8d5659f4866b5696a809abf8c48b231db6e6a690f

  • SHA512

    f01d1c90cd261c21a7536cc907e9bf3d0a6e3b45f6f60cc18da9350f687116d404161c1d5ead05bcad30da8b2f0c94fc3068389db6820be16a06fbf8cad10dcd

  • SSDEEP

    6144:011QE6KflZF3TcH76K9Wwj1JJUkOOeaGO+/5cX52J2w:sFrITWwBJJfOOfGB/Q2Jr

Malware Config

Targets

    • Target

      e049bf2e95cfd9354cd04da57dc33e0d_JaffaCakes118

    • Size

      345KB

    • MD5

      e049bf2e95cfd9354cd04da57dc33e0d

    • SHA1

      e5b896193a4bcfd10723dd914e2f19fd693df9b3

    • SHA256

      2122beff06c9c868008da7f8d5659f4866b5696a809abf8c48b231db6e6a690f

    • SHA512

      f01d1c90cd261c21a7536cc907e9bf3d0a6e3b45f6f60cc18da9350f687116d404161c1d5ead05bcad30da8b2f0c94fc3068389db6820be16a06fbf8cad10dcd

    • SSDEEP

      6144:011QE6KflZF3TcH76K9Wwj1JJUkOOeaGO+/5cX52J2w:sFrITWwBJJfOOfGB/Q2Jr

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks