General

  • Target

    eb649f905b80b143b6637a1561b320ab_JaffaCakes118

  • Size

    528KB

  • Sample

    240919-qbty3szcmh

  • MD5

    eb649f905b80b143b6637a1561b320ab

  • SHA1

    5b7b6e51e319d43967c3a949bfd61172e691915c

  • SHA256

    8151856cd34b1828fbe37b7f43b2d4329c8dea1131a285472a8b5f36ad1cac04

  • SHA512

    cc92695d154d24bf040aa349b8c52010acba7af0327c9b0bcf354f76f240eb6401cbe2e8b00f5b0dc0af8cabec91d43aabe1b33ffeef1704394908b53c566650

  • SSDEEP

    12288:jsTj/uiqpGhXGWB80yPQzmAiWeZAykHLzExTCLNmTYY8YbsKOSgJ/wWGw/KI60yq:7u+nsxLBeuZ0Pj4jnQFihFOm

Malware Config

Targets

    • Target

      eb649f905b80b143b6637a1561b320ab_JaffaCakes118

    • Size

      528KB

    • MD5

      eb649f905b80b143b6637a1561b320ab

    • SHA1

      5b7b6e51e319d43967c3a949bfd61172e691915c

    • SHA256

      8151856cd34b1828fbe37b7f43b2d4329c8dea1131a285472a8b5f36ad1cac04

    • SHA512

      cc92695d154d24bf040aa349b8c52010acba7af0327c9b0bcf354f76f240eb6401cbe2e8b00f5b0dc0af8cabec91d43aabe1b33ffeef1704394908b53c566650

    • SSDEEP

      12288:jsTj/uiqpGhXGWB80yPQzmAiWeZAykHLzExTCLNmTYY8YbsKOSgJ/wWGw/KI60yq:7u+nsxLBeuZ0Pj4jnQFihFOm

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks