General
-
Target
e08f72d878b359150c2bb3668b259f8a_JaffaCakes118
-
Size
391KB
-
Sample
240914-tsd6qssgpp
-
MD5
e08f72d878b359150c2bb3668b259f8a
-
SHA1
b25fba7bd852d53c75106946663725f879ed3f1b
-
SHA256
803e4f7759e21b0d2c93f4e43e93e928cf0df1eac2da8ce3f4eded5be6102635
-
SHA512
eef31bc51bdff0e96c8d02c4e94b7ec480750461e28e85a7add40446f56ee3c2d1e79e083b2e7e478508295b764df1b95f98c282faf89ad6f8d78e010d982b10
-
SSDEEP
12288:eX6tKLTioNKGjrsAZV4BQQXBPwV5l9oo/Q2/Det:E6tKLnNKWrXDiwfioDa
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order 4589012.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Purchase Order 4589012.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.meiaduzia.pt - Port:
587 - Username:
[email protected] - Password:
Loja_Flores!1
Extracted
agenttesla
Protocol: smtp- Host:
mail.meiaduzia.pt - Port:
587 - Username:
[email protected] - Password:
Loja_Flores!1
Targets
-
-
Target
Purchase Order 4589012.exe
-
Size
593KB
-
MD5
c14996b07681c32bfffc365b67b85be5
-
SHA1
3eef1730c800fb66ddcfdf03dff1a430886694d1
-
SHA256
ccb65f79de018225e7ca824cc70f81726e771019e53785d7a2a3772548fcfa23
-
SHA512
2a1dce34ab3163da645dc94e5695805b5d3485c0095504625c5b56a51c135eae2a2a326aa978c77fa46521ab6f6b41bac2332c52883745b0eb07821aa6b0b6b7
-
SSDEEP
12288:srjcW2k4zUwiOZKWj9sIZVETEwXBDwVbl9oQFQC/MRBaTJr:srYHZKm9/9COJy0w
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1