Overview

overview

10

Static

static

3

ed8ef945d7...18.exe

windows7-x64

10

ed8ef945d7...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed8ef945d7d259824b4b5590c539c0b6_JaffaCakes118

  • Size

    737KB

  • Sample

    240920-pc4dgawcqn

  • MD5

    ed8ef945d7d259824b4b5590c539c0b6

  • SHA1

    5e2768f9c981e83c4761a849b4b6b19cc1decc61

  • SHA256

    abeb6c60fb8519e50226482c903a270a9d5012370e082f6a60aca96c64ff9cc1

  • SHA512

    b519fd4c992b041cd329a1d6bed9ec3f927aa1279c69eb87ef325023a4a277d426518e08475c1da24a016606a679796bb125273bbd2d10add8be3d9c15749ca6

  • SSDEEP

    12288:jSQYzdnLpsnzBhGxR3PqG073wHGc6uB3XdtgnUPTZ:jSlzdn4Tw3iGEkwuBdKQ

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    #Wild123

Targets

    • Target

      ed8ef945d7d259824b4b5590c539c0b6_JaffaCakes118

    • Size

      737KB

    • MD5

      ed8ef945d7d259824b4b5590c539c0b6

    • SHA1

      5e2768f9c981e83c4761a849b4b6b19cc1decc61

    • SHA256

      abeb6c60fb8519e50226482c903a270a9d5012370e082f6a60aca96c64ff9cc1

    • SHA512

      b519fd4c992b041cd329a1d6bed9ec3f927aa1279c69eb87ef325023a4a277d426518e08475c1da24a016606a679796bb125273bbd2d10add8be3d9c15749ca6

    • SSDEEP

      12288:jSQYzdnLpsnzBhGxR3PqG073wHGc6uB3XdtgnUPTZ:jSlzdn4Tw3iGEkwuBdKQ

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks