Overview

overview

10

Static

static

3

IMG_530000...53.scr

windows7-x64

10

IMG_530000...53.scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f829e4e6967c730d6cc39fac19298e37_JaffaCakes118

  • Size

    1.4MB

  • Sample

    240926-mf68esvgpa

  • MD5

    f829e4e6967c730d6cc39fac19298e37

  • SHA1

    ca2ffbf4027d5632346df15ab0bf907aa56f5068

  • SHA256

    a91c94f163e9c6010acecd0e0407f0c7ec1e472f5f899c3189ec57bcc3e3d696

  • SHA512

    e9280a3d5bc841f8886cf48bcb7c5bfaf44ac3b584bab3cb7e2d362b516a3ffdb8c01081b1c08e4c80b52b7bdcfb2052fee1feeaa4099a494cfa51c714fb9aa3

  • SSDEEP

    12288:kt/JBIuPj/D9wd8MwUccWG+D/4FXIfRlaadlBhdA6Os5P/Zdhs0Ji:kZfjj79woXT4FuRla8hdhFP/Zd

Score
10/10
agentteslacollectiondiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    terry123@

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    terry123@

Targets

    • Target

      IMG_530000453128990453.scr

    • Size

      829KB

    • MD5

      3ac4826e47cef5ee17bf249ceac93efa

    • SHA1

      80683d9daa055033c5156ac5fa64057d3d6f8106

    • SHA256

      1afdb98e49369ba0656bf25320298cea5fb246e651499836028cc342b6c9e805

    • SHA512

      a8e621d15a3cc6c4f6e9f439bf006db45a28f6f676d47187232244ca624042729e8c9a10991d041c0c1a4276184c8308284fc216070defc3ce4b3986f31f3a54

    • SSDEEP

      12288:at/JBIuPj/D9wd8MwUccWG+D/4FXIfRlaadlBhdA6Os5P/Zdhs0Ji:aZfjj79woXT4FuRla8hdhFP/Zd

    Score
    10/10
    agentteslacollectiondiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks