Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
fa6ab169c3da99ccb2cdaa7251babeac_JaffaCakes118
-
Size
553KB
-
Sample
240927-pr6gdasfrr
-
MD5
fa6ab169c3da99ccb2cdaa7251babeac
-
SHA1
ef14e67d4108b90f75d9b3fd2eb7f81a19d22bb3
-
SHA256
00c0720db185618e9ce9f91b819fcd1c2dfdc909fb4c3eeb224ad83d2551abb2
-
SHA512
944d56f845373f04c21344f4f1068c92fc9153e514a287dfde284fdef59d0f2d6a58f4b7edf86ce83320de20db291d8e8674952794799afa1b3fddac597c826f
-
SSDEEP
6144:GVULHGE5IqXcpxZ1xPXj+GiyoESj9QWjFST6fNRw2WABakFJaKeUbSmlokfXMJr+:TgSjWWjFSOfZratqoSXoe6gxxHK
Static task
static1
Behavioral task
behavioral1
Sample
fa6ab169c3da99ccb2cdaa7251babeac_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fa6ab169c3da99ccb2cdaa7251babeac_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.gautengelectrical.co.za - Port:
587 - Username:
[email protected] - Password:
prisci7766 - Email To:
[email protected]
Targets
-
-
Target
fa6ab169c3da99ccb2cdaa7251babeac_JaffaCakes118
-
Size
553KB
-
MD5
fa6ab169c3da99ccb2cdaa7251babeac
-
SHA1
ef14e67d4108b90f75d9b3fd2eb7f81a19d22bb3
-
SHA256
00c0720db185618e9ce9f91b819fcd1c2dfdc909fb4c3eeb224ad83d2551abb2
-
SHA512
944d56f845373f04c21344f4f1068c92fc9153e514a287dfde284fdef59d0f2d6a58f4b7edf86ce83320de20db291d8e8674952794799afa1b3fddac597c826f
-
SSDEEP
6144:GVULHGE5IqXcpxZ1xPXj+GiyoESj9QWjFST6fNRw2WABakFJaKeUbSmlokfXMJr+:TgSjWWjFSOfZratqoSXoe6gxxHK
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-