Extracted

• • Target

    37c89e5d5fcb103c1c8679bc3207fb37_JaffaCakes118

  • Size

    604KB

  • MD5

    37c89e5d5fcb103c1c8679bc3207fb37

  • SHA1

    2075a5aab3e1653a9b93ff7f59974b9260a4f12c

  • SHA256

    17b94c53b369665b9816ac41c7b92ecd8d25cea5525960f9d9fdec61302d70b9

  • SHA512

    b988a0b6012390d7df7de10ffd057811ff6ce9d0a04176f2085532b9ecfe37cd62a87f91d780b8caeae83548573061e87c69118277cdd40fb659457adc7b5829

  • SSDEEP

    12288:lEhv/UO+bmk2aYXqBx7bEF5g5OnfQH59c2/eg0:KnUO+B1jx7bCNnfQrcw

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2