Extracted

• • Target

    d6ae4df904afd895805671c5fe27cecb_JaffaCakes118

  • Size

    469KB

  • MD5

    d6ae4df904afd895805671c5fe27cecb

  • SHA1

    efcd9150f4e8e634105432b5710986850467d843

  • SHA256

    193fe7f7fc4dec6fb1c6cbd7071f1feb6021dd3c570e219927faefdf499fb096

  • SHA512

    2d0618606437747c2d01e14eed5ce71f0d5b0ed580f12edb0c3ff9d5a9c892b3dc768be027ffe3c55fc7b3541073835e352b5db78eb4bc390cd22e008d01d652

  • SSDEEP

    12288:DWMf9/jtBkKp2iya2En4hDDqJ0npuIOb5Rk4b:DTf9/pqKp2zab4hDm0ROtRkc

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2