Extracted

• • Target
    529d0f79119e4c926e0d65734d1883cb_JaffaCakes118
  • Size 401KB
  • SHA256 9c61440a4a2ad386598c39acd77ee3644b28d5339786b7c6c15decd446328d98
  • MD5 529d0f79119e4c926e0d65734d1883cb
  • SHA1 328084f47f1ffb1b819e6a128176fb2bd66dbd66
  • SHA512 32dcdd0945691df5ad93631838c68cc625d53a2519001ee23bf012f977e7fac6848e17e3028ba31a294e8b3f15a537fdd74c4bee8fb1a41ca13ce8768b021030
  • SSDEEP 6144:+JZj3XBjlkq27zgxRVeDErEhnktgb5GlRbdfSG:azZo7cvoDErKnOu5sR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2