Extracted

• • Target

    3c6392f463186502fd3ef212dd9ffba8_JaffaCakes118

  • Size

    395KB

  • MD5

    3c6392f463186502fd3ef212dd9ffba8

  • SHA1

    a77b8b9ae95cf3512eaedcb26b8d1949ae482686

  • SHA256

    cb3056bb2991eac62d5185c9b09b1d2e9686f7b040966b9f46e9f05af8ab163f

  • SHA512

    db10a82f1c56427e7cde2e195fbbba0cd23745e00bdb74c8b849304cdfa171f7052335c49f1eace329717cf9bec2fec192729d2751fd32b814eafd7cd0f88514

  • SSDEEP

    12288:LjA/PSieao+DB0/vXDYHjNKm8ItKVxLW:UP3eaZN4zaNtrwxi

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2