Extracted

• • Target

    ff5d0a2b5fa45ddcdb3471236adf7b9c_JaffaCakes118

  • Size

    633KB

  • MD5

    ff5d0a2b5fa45ddcdb3471236adf7b9c

  • SHA1

    9d03755918f0b8c9bc7436b96c480564574bb446

  • SHA256

    e352fd57db8a0670353e1c3caf02fd7d83fb315bb2e519b48dccd27eb3a2c456

  • SHA512

    44bc2df5a37745b6f19cc99482d6415452736ba74ee95e3278380069cef01c8ad390a00b4a804fbf132f69abec381c76554f05d1fcc73297a2bfdfc10f9a72d1

  • SSDEEP

    12288:WsH4A6bE6XU+qBBAWJCIzk0kwM8kLd5rlUjPF7Z4gx79OfF5Jx2VncswAb7mo5oi:WsH4XXFp1Iz2Zd5xUjPFqA9Ec7mo5oFY

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Drops file in Drivers directory

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2