Extracted

• • Target

    cc0bfaf65e74fe68a2340977e8565b96_JaffaCakes118

  • Size

    683KB

  • MD5

    cc0bfaf65e74fe68a2340977e8565b96

  • SHA1

    56b16c4e707ed394b8dde5fbd955b3313a19e5e6

  • SHA256

    135e423a3e052c3f4cb4180f970e13af7c8cab393a708e48d7dfefb5cf035313

  • SHA512

    9f920b628a886500d0a352b7d862ad1f33cc05b412091212be64aeb224deb813c515e1ff175c39398e8d7ea1462e7e45271ec6dff4ea574e48169c0c54631e6c

  • SSDEEP

    12288:KHqkXkmYAbJO6yS1/SnpBf5S0s0EJoApCJWX0nSxZYc:WXYAdO2qBpsrXp8WX0Sxt

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2