Extracted

• • Target

    e812ae485011a55057cce00cfaf1d9e5_JaffaCakes118

  • Size

    925KB

  • MD5

    e812ae485011a55057cce00cfaf1d9e5

  • SHA1

    05e607c17a9146b5f9c9152ebf33f81e62645985

  • SHA256

    10218b537bfd6abc2652c9f3dd158c5a9e769ccbc9fca7ecb4a304a4fcacbd92

  • SHA512

    60672683ee26dac0cb8ff1a60b579e2fbc5173bf5596589617c6e5253aba1a0f9cdd5280b51c0f18ba85fdd94688cdce83285eb3261dcc835740f72ba4b3531d

  • SSDEEP

    12288:wjcsGI/czJlszkbbrO1FP12zN62H5WLmlwM9VfthwVMn1Q/evlfEYi6IXduXV62D:we0QrOvP1Yn5WLmx912MnqqhEYi6eoE

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2