General
-
Target
00eaacfc4c7d1d1bef21c3e3577c712c_JaffaCakes118
-
Size
495KB
-
Sample
240930-mtgjxs1bjr
-
MD5
00eaacfc4c7d1d1bef21c3e3577c712c
-
SHA1
11b2b064be5a5e2971a24baae3ec6bf6082fec79
-
SHA256
5e7c160d68832c6b823474419cb0c54b79b57964e997eced8c175fa453def2e3
-
SHA512
ad88809d47e44dac842a8b70d1a7d6587e39721c8b2ade613220da9b4f6efa7f0797043c737248072dc666f65cbf69a1e9af6821d2e6b571e1c2f9e1e3fac11a
-
SSDEEP
6144:wFmVYVqITth8UetA8aI8RU0c0QGpXXtKfnVS2M3F7XEmiO+gs3FS59IyKpUuFR:6FF8UetA3u0QGtXQlMXEmiOxCEDuR
Static task
static1
Behavioral task
behavioral1
Sample
00eaacfc4c7d1d1bef21c3e3577c712c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
00eaacfc4c7d1d1bef21c3e3577c712c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.bafaqroup.com - Port:
587 - Username:
[email protected] - Password:
bs%K^dS2
Targets
-
-
Target
00eaacfc4c7d1d1bef21c3e3577c712c_JaffaCakes118
-
Size
495KB
-
MD5
00eaacfc4c7d1d1bef21c3e3577c712c
-
SHA1
11b2b064be5a5e2971a24baae3ec6bf6082fec79
-
SHA256
5e7c160d68832c6b823474419cb0c54b79b57964e997eced8c175fa453def2e3
-
SHA512
ad88809d47e44dac842a8b70d1a7d6587e39721c8b2ade613220da9b4f6efa7f0797043c737248072dc666f65cbf69a1e9af6821d2e6b571e1c2f9e1e3fac11a
-
SSDEEP
6144:wFmVYVqITth8UetA8aI8RU0c0QGpXXtKfnVS2M3F7XEmiO+gs3FS59IyKpUuFR:6FF8UetA3u0QGtXQlMXEmiOxCEDuR
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-