Extracted

• • Target

    d19a8b68191b847d63e12b7d1359c311_JaffaCakes118

  • Size

    980KB

  • MD5

    d19a8b68191b847d63e12b7d1359c311

  • SHA1

    63366e372cc4da57ba4042722fee78a937f5ca35

  • SHA256

    a65c812000900485065a8a2d13fed88aeb45077d8bd14424fe4a3a363e147e14

  • SHA512

    f2c071d357456ad21e9b87e93d174e79ac162ce3df095ba8f7d207b3eed22d2de7a06bf525f5fb57cea7596b2c30041810e3a0530aa8caec2696da89088cc377

  • SSDEEP

    24576:fhl3OMC1i3yFFWi9RbGh63yd2OluON4fA9uC:fhZO11ia19tGh63yd2OluON4fA9u

  Score

  10^/10

  agenttesladiscoveryevasionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2