Extracted

• • Target

    c6f96119575eca1f86d2013ed7b66e95_JaffaCakes118

  • Size

    583KB

  • MD5

    c6f96119575eca1f86d2013ed7b66e95

  • SHA1

    35894722c984f00821a53dfb728bf808f22f0f05

  • SHA256

    66ee4b53abb08b5133bc88f5fa911e091420bd47744384ec9d0d56a408bebea7

  • SHA512

    4a434bb510bceb815de7ea84431c0454a38e6f3b9daba69cf406450ccdec41c24afd409d8090321c95db894d38a3fb670ca1e702b26798431857e8a9f6e22945

  • SSDEEP

    12288:Q0wPMYSBJXdjmUH8Nzt8vce3GzAScGM5UWffALfAoP4aduEmQ8w0Q:9QeBvmUUKACvfALff4aF83

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2