Overview

overview

10

Static

static

3

f8c510bc32...18.exe

windows7-x64

10

f8c510bc32...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f8c510bc32463ee61aa511876ebba34f_JaffaCakes118

  • Size

    458KB

  • Sample

    240926-t1a42sxaqr

  • MD5

    f8c510bc32463ee61aa511876ebba34f

  • SHA1

    2623245c09b4fe05069fd0cc3b74392bbc322ed3

  • SHA256

    3e4300ecf577536b117479a854a2a7cefee07eb1da32d8f0cb289c6242220caf

  • SHA512

    785506d14ae442aa453ef9dde64a1e838b48502402d1470c4902aa1463ccf61431ec647642b4d0f513131c0a0c2d603dcc28f837ae2cc8f9a15bc27fa014cfdf

  • SSDEEP

    6144:Jr52OKwdaN0DFaQbskMv2hRdwkI6WNQa75hQWIs3gGPH7aodGBtTw2IKtTl+0BHZ:DRKo3DFlJZRnta3QSrHEtTw2IKDL

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      f8c510bc32463ee61aa511876ebba34f_JaffaCakes118

    • Size

      458KB

    • MD5

      f8c510bc32463ee61aa511876ebba34f

    • SHA1

      2623245c09b4fe05069fd0cc3b74392bbc322ed3

    • SHA256

      3e4300ecf577536b117479a854a2a7cefee07eb1da32d8f0cb289c6242220caf

    • SHA512

      785506d14ae442aa453ef9dde64a1e838b48502402d1470c4902aa1463ccf61431ec647642b4d0f513131c0a0c2d603dcc28f837ae2cc8f9a15bc27fa014cfdf

    • SSDEEP

      6144:Jr52OKwdaN0DFaQbskMv2hRdwkI6WNQa75hQWIs3gGPH7aodGBtTw2IKtTl+0BHZ:DRKo3DFlJZRnta3QSrHEtTw2IKDL

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks