Extracted

• • Target

    647b63c7412724be299a54f055a7ac0e_JaffaCakes118

  • Size

    534KB

  • MD5

    647b63c7412724be299a54f055a7ac0e

  • SHA1

    d57702128a1767dc7440cf503a691fd94be6bc06

  • SHA256

    8e2cf8c9a6ea55908c4294c8a8dc129600d79a19356d14014db6e851759c11a4

  • SHA512

    8bca891764eba939e77085ad0d370155687352b0057fbf8cbf7cc8ac769073b7fc064f1330b1145325bbd725d5f339d1718227b7f56673c387cfb5b21acebac1

  • SSDEEP

    12288:ZlIqjP6eP9BF0PsbQlSxJ3uPDpT/18xy4TSa4:THjP6+B7QIx4DpT/18xjSa4

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2