Extracted

• • Target

    3a864f29c4e358887ecab0c0c5026ed2_JaffaCakes118

  • Size

    590KB

  • MD5

    3a864f29c4e358887ecab0c0c5026ed2

  • SHA1

    5c5269bd9f4a967d0632cb7b15ac3c918b4e4ca2

  • SHA256

    9fef5950c5cbed99b2ae8e5cc3de14fa3534352d97b9eb85d05fa9e83731beaa

  • SHA512

    e1c49f7262887244e4bb13ecf028b0e247f02967821b2b5775793758ca9326584b7fa0c086159a892a8d11d15387208c0a0be8396948ed1a03fe7aebe6de889d

  • SSDEEP

    12288:4hwYEfl2HxPR/WhQgblpOTgR+8wHPU7qt9wWXqsmgISPoq3eSBQL1l:+dMbwH8OAW6smrXqzBEH

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2