Extracted

• • Target

    3667ccf1f3cf2cccb751b06ed3c5dab4_JaffaCakes118

  • Size

    405KB

  • MD5

    3667ccf1f3cf2cccb751b06ed3c5dab4

  • SHA1

    aeba56440fb1da2ad9ba73142ae6a153dc892e3e

  • SHA256

    37766ff8af0d6cd5ff8df2eb44dcb1ef21f3f2534d3b295833f0fa4346d0769c

  • SHA512

    633372ff54b5f3c73c9e438989e18d64d39116bb3a21e076a2f7fd75f670ece2f0044136f1596bee79e9c7456fa5f74ee0a68896c4508208e2d80ed7b7367438

  • SSDEEP

    6144:rePYwnnm344n3pd6WY1hO1361PC7QubYMrdSPsUVlOukDrG09AZXG9wBbY:r34sxpqO1KRDubBdqzVlwHeiwS

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2