Extracted

Extracted

• • Target

    d6146d239a05c6d745c1e3b28549e9f7_JaffaCakes118

  • Size

    461KB

  • MD5

    d6146d239a05c6d745c1e3b28549e9f7

  • SHA1

    8f227101cdd53c7083e0d2e3a0ac183ef56695bd

  • SHA256

    567fe2998412b937355f663996f1a851aa06217d3f56626b3a6d8cae3194d194

  • SHA512

    a68bce77bba9fc1657090720e67cf890ac2af63f904ff7bcb9ba5100f5dff8fa0b0d40c3b35e004e41172ef539b96c1c7fee16c99428cc21ee531db88d01b630

  • SSDEEP

    12288:Jfh5MGx0fHY//YYZN1VI2BiwOhQxDEJdfEioqkY0:iU0fYIeNXGhyEJdN9kY0

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoveryevasionkeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2