Extracted

• • Target

    c0f0ad839576a174072d3fdb657159a1_JaffaCakes118

  • Size

    691KB

  • MD5

    c0f0ad839576a174072d3fdb657159a1

  • SHA1

    c06460aa2a5470e615e632bc2df62f54a969c53f

  • SHA256

    c02e6e6559c85349d2be3c931b387092ef50b3a33197614e441135e3284059ed

  • SHA512

    9a8aba1558f0fd3a64893258e710bac1820e82f119d33d165f7b10ad738f7dfca3b533ea7aecaa98581b2af610a69b72a57d7cf1d84418d9c5b79aa82b1d0865

  • SSDEEP

    12288:Lhv05rdERQin/L/yrxnuOb/wICNnsEp2CYW6B4lHk0:Vkr+uBQICNn/4BUm

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2