Extracted

• • Target

    05332d194f758eae4b12ddda44c7dcda_JaffaCakes118

  • Size

    806KB

  • MD5

    05332d194f758eae4b12ddda44c7dcda

  • SHA1

    f4adabb9f3650c4d4f1b713f00cf60dda1134cc3

  • SHA256

    5671f534a875a0e788b94fe86518fff5cd713d8df079877a319652274aa68fa0

  • SHA512

    b7129b6cfdbc23887bef311709920b1672118c61ada6ca410c2a8c3d7765ef04b39df1d98341dbec829e02dde9627f591a9b06ef53cc3d3305d86c23f7647494

  • SSDEEP

    12288:xvmIXWFDiG5FFLbbMvVEbbU4NYLsI68Y/EDlfR+k7SDCMKcaPnOz:A5XbMibnisIvYk2GMKcaPnOz

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2