General
-
Target
e9a9ba0db77539c55bce8f85bca240a0_JaffaCakes118
-
Size
348KB
-
Sample
240918-weyz4avfjl
-
MD5
e9a9ba0db77539c55bce8f85bca240a0
-
SHA1
084206e4edefd6589f4debf904697b0924b2a76a
-
SHA256
d6a5d01edf06c2812aec143d767d5ed3a18ca7386a7470f9e7c8d08e49b0c366
-
SHA512
b814610733f42f8312c66d155c9f23f1d95a79ae6ac221047535254bcf55eb543cedf1b528670a4aa0cff64b713702af81a1ea1a2d151a4945c62cf91bc58997
-
SSDEEP
6144:Wfw5rf3oNO0zTFK6rtjc+eRIQ16Q79rkqvtJSWx0IQ:yO4xoyeRJ16O9rkmtVx0IQ
Static task
static1
Behavioral task
behavioral1
Sample
e9a9ba0db77539c55bce8f85bca240a0_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e9a9ba0db77539c55bce8f85bca240a0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.microtop-jp.com - Port:
587 - Username:
[email protected] - Password:
HirONori0504 - Email To:
[email protected]
Targets
-
-
Target
e9a9ba0db77539c55bce8f85bca240a0_JaffaCakes118
-
Size
348KB
-
MD5
e9a9ba0db77539c55bce8f85bca240a0
-
SHA1
084206e4edefd6589f4debf904697b0924b2a76a
-
SHA256
d6a5d01edf06c2812aec143d767d5ed3a18ca7386a7470f9e7c8d08e49b0c366
-
SHA512
b814610733f42f8312c66d155c9f23f1d95a79ae6ac221047535254bcf55eb543cedf1b528670a4aa0cff64b713702af81a1ea1a2d151a4945c62cf91bc58997
-
SSDEEP
6144:Wfw5rf3oNO0zTFK6rtjc+eRIQ16Q79rkqvtJSWx0IQ:yO4xoyeRJ16O9rkmtVx0IQ
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1