General
-
Target
ea3e5059033a6fd09d408317553171ea_JaffaCakes118
-
Size
952KB
-
Sample
240919-anglhs1bqd
-
MD5
ea3e5059033a6fd09d408317553171ea
-
SHA1
cc8fd5a89265ae21677f3cb2bd31d3491d0e9b94
-
SHA256
f87bef1ec7a4e68e8a9d2765a5fbfe2e0a66144a1efab71af82caad271654ee2
-
SHA512
4b9b18b5fdfb863e49bb7e356dba7ec04fef494a499b436cde83f9dfdc05b4040a8f014d16e4e5274974475ce41c698759cbe10bce7d1d8efd6f6725cb81ea9a
-
SSDEEP
24576:M5AsZjqYVU+wkxX2vQsPFPjvZ9Xnbc9mj:UZjqYlBQPj/Xnbomj
Static task
static1
Behavioral task
behavioral1
Sample
ea3e5059033a6fd09d408317553171ea_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ea3e5059033a6fd09d408317553171ea_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.flagmonkey.com.au - Port:
587 - Username:
[email protected] - Password:
Enter@222F
Targets
-
-
Target
ea3e5059033a6fd09d408317553171ea_JaffaCakes118
-
Size
952KB
-
MD5
ea3e5059033a6fd09d408317553171ea
-
SHA1
cc8fd5a89265ae21677f3cb2bd31d3491d0e9b94
-
SHA256
f87bef1ec7a4e68e8a9d2765a5fbfe2e0a66144a1efab71af82caad271654ee2
-
SHA512
4b9b18b5fdfb863e49bb7e356dba7ec04fef494a499b436cde83f9dfdc05b4040a8f014d16e4e5274974475ce41c698759cbe10bce7d1d8efd6f6725cb81ea9a
-
SSDEEP
24576:M5AsZjqYVU+wkxX2vQsPFPjvZ9Xnbc9mj:UZjqYlBQPj/Xnbomj
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-