General
-
Target
ea6de27b46dcb75eb35152d2ef0143bd_JaffaCakes118
-
Size
1.3MB
-
Sample
240919-c3y58awgkd
-
MD5
ea6de27b46dcb75eb35152d2ef0143bd
-
SHA1
9a48bd12e423fc98102d8a17c3f044264e3d76eb
-
SHA256
f32aaffbbf2bcaee36c603364a794939abf6039613fea0f833cb48a113eca2c3
-
SHA512
55d6ea14f5e88cb1fd16436033e888d1b15207da85e6f3b4a99c4b363ffe12f849e057f85f452adc46bc1f63593ec10c9acd82be4a5a1f767294188096e01014
-
SSDEEP
24576:2wMbU88WyT5RX+JaZeLjP4AtqmqB35NoSnAWaI4R7wDS:zMA8fytROsUjhQhjTZaI4RsS
Static task
static1
Behavioral task
behavioral1
Sample
LPO FOR QUOTATION.docx.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
LPO FOR QUOTATION.docx.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
ike2020.xyz - Port:
587 - Username:
[email protected] - Password:
Dollar$45
Targets
-
-
Target
LPO FOR QUOTATION.docx.exe
-
Size
1.8MB
-
MD5
9c1c2f429f7db2bed52d564f2584cb29
-
SHA1
6ba49f12310ee712788f51581969c9ecbeb6d1f9
-
SHA256
e2233b7eb2b39904c37d4e334b857f49ac367a273d694145647be38c39bd38b4
-
SHA512
d34582e0d45dc8195a5dc52b295c2fd464484f1391047283ef1e8dddeb8f8cb73aa114bb3b8dde48e94ec6341ca1f9bba14fd6bfeab590113ac26b037002a5aa
-
SSDEEP
24576:Atb20pkaCqT5TBWgNQ7aAji9a5+bjL4atYKq3H5HyWnUWeCMh9sD9T6A:JVg5tQ7aA2a+jRIXhN9eCMh6Z5
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-