General
-
Target
ea403e1bb4a9cf49271f3db52713a1e4_JaffaCakes118
-
Size
934KB
-
Sample
240919-arhb8a1emq
-
MD5
ea403e1bb4a9cf49271f3db52713a1e4
-
SHA1
53f7b70ebc686e242db4c4697d6b2cc43136e304
-
SHA256
43649db543f21ac9af73d9f7e301935f29cb93d0d10050253fc552842129dd0b
-
SHA512
baff86e292933f1289d4a5e043a9cf4e6088146fe3ce9f02d75a828dda3176c5314fbba60afdd81aedeb1bd630afc78e58756c5f5079233a298fb4cb4d30ebdc
-
SSDEEP
24576:PuBeHtiJMJkpuq0Ua/E7QudIC158NWo/NwQWSRn6qkq:2wNEMmpuUas7dx5qVwQWSR6qkq
Static task
static1
Behavioral task
behavioral1
Sample
PDF4563784.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
PDF4563784.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.totallyanonymous.com - Port:
587 - Username:
[email protected] - Password:
572h094S - Email To:
[email protected]
Targets
-
-
Target
PDF4563784.exe
-
Size
1.1MB
-
MD5
f716b9d1dfef7d20b0afc1b4084f39b6
-
SHA1
01536c02c2e8b232a36cf338c3f1007774830702
-
SHA256
18a2826ae0c8ce3e76a5cb806e89d0070f70cc372cf37468721b8caf8529f401
-
SHA512
ac69e2ff2f18462cd251bee3c9667e794f2156ab89cd57ca73603c308fe298a2b9f20d262161a2ba4d098ec0ba49b08dcc033d6373c4d6f27763c9ddf446b782
-
SSDEEP
24576:qTiZucOaCrYz4jEmW/g+bRrSPMzIW3C453xSo4uKNPlS:CcyrKmW/PFSPNU53xUPA
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-