General

  • Target

    ea403e1bb4a9cf49271f3db52713a1e4_JaffaCakes118

  • Size

    934KB

  • Sample

    240919-arhb8a1emq

  • MD5

    ea403e1bb4a9cf49271f3db52713a1e4

  • SHA1

    53f7b70ebc686e242db4c4697d6b2cc43136e304

  • SHA256

    43649db543f21ac9af73d9f7e301935f29cb93d0d10050253fc552842129dd0b

  • SHA512

    baff86e292933f1289d4a5e043a9cf4e6088146fe3ce9f02d75a828dda3176c5314fbba60afdd81aedeb1bd630afc78e58756c5f5079233a298fb4cb4d30ebdc

  • SSDEEP

    24576:PuBeHtiJMJkpuq0Ua/E7QudIC158NWo/NwQWSRn6qkq:2wNEMmpuUas7dx5qVwQWSR6qkq

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      PDF4563784.exe

    • Size

      1.1MB

    • MD5

      f716b9d1dfef7d20b0afc1b4084f39b6

    • SHA1

      01536c02c2e8b232a36cf338c3f1007774830702

    • SHA256

      18a2826ae0c8ce3e76a5cb806e89d0070f70cc372cf37468721b8caf8529f401

    • SHA512

      ac69e2ff2f18462cd251bee3c9667e794f2156ab89cd57ca73603c308fe298a2b9f20d262161a2ba4d098ec0ba49b08dcc033d6373c4d6f27763c9ddf446b782

    • SSDEEP

      24576:qTiZucOaCrYz4jEmW/g+bRrSPMzIW3C453xSo4uKNPlS:CcyrKmW/PFSPNU53xUPA

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks