Extracted

• • Target
    ae44866327aa5d13d73963426dc48494_JaffaCakes118
  • Size 696KB
  • SHA256 476ad07360e7dc543be24793d393a093a011090ba53b5aafb21069d177271e7d
  • MD5 ae44866327aa5d13d73963426dc48494
  • SHA1 bde1e40b8cf96b30512b63ecd395e5a139dd2ba3
  • SHA512 c5fb95d5f1efcb2cbbfb10f870d7531556997fa2c3ad77eca62e4469cbc4e3837f91a50c9c0d9e19e854d682199c43ee246d19434af2ef3460492e6770e38f65
  • SSDEEP 12288:IExvMiLY3QtkrvHsXtqx8JNjME8YsfO9G8INONal+r02iTClHfRXYxPDGcazg:IExvMiLYAkrvOtZLjME8Yt9GrONaMITX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2