General

  • Target

    ea6de27b46dcb75eb35152d2ef0143bd_JaffaCakes118

  • Size

    1.3MB

  • Sample

    240919-c3y58awgkd

  • MD5

    ea6de27b46dcb75eb35152d2ef0143bd

  • SHA1

    9a48bd12e423fc98102d8a17c3f044264e3d76eb

  • SHA256

    f32aaffbbf2bcaee36c603364a794939abf6039613fea0f833cb48a113eca2c3

  • SHA512

    55d6ea14f5e88cb1fd16436033e888d1b15207da85e6f3b4a99c4b363ffe12f849e057f85f452adc46bc1f63593ec10c9acd82be4a5a1f767294188096e01014

  • SSDEEP

    24576:2wMbU88WyT5RX+JaZeLjP4AtqmqB35NoSnAWaI4R7wDS:zMA8fytROsUjhQhjTZaI4RsS

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    ike2020.xyz
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Dollar$45

Targets

    • Target

      LPO FOR QUOTATION.docx.exe

    • Size

      1.8MB

    • MD5

      9c1c2f429f7db2bed52d564f2584cb29

    • SHA1

      6ba49f12310ee712788f51581969c9ecbeb6d1f9

    • SHA256

      e2233b7eb2b39904c37d4e334b857f49ac367a273d694145647be38c39bd38b4

    • SHA512

      d34582e0d45dc8195a5dc52b295c2fd464484f1391047283ef1e8dddeb8f8cb73aa114bb3b8dde48e94ec6341ca1f9bba14fd6bfeab590113ac26b037002a5aa

    • SSDEEP

      24576:Atb20pkaCqT5TBWgNQ7aAji9a5+bjL4atYKq3H5HyWnUWeCMh9sD9T6A:JVg5tQ7aA2a+jRIXhN9eCMh6Z5

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks