Extracted

• • Target

    d6d3132a0431521b09d2676cbcea4576_JaffaCakes118

  • Size

    617KB

  • MD5

    d6d3132a0431521b09d2676cbcea4576

  • SHA1

    1405f4660aeef613e025ef9eb24fcd13a964ac05

  • SHA256

    afafbb95e4eb72548c8f10df5e8af4546b83e7e69bd65cdbc20f58b2e6f89343

  • SHA512

    aa922e2153206ae79f9a2835ccd22dc9819d92b3f0090bfd383247cbd30854ce223a993726bf204e79af7a16c0b608523e3d4749fbfa141a6d4eefaa045c93b4

  • SSDEEP

    12288:sYqBEXzBEenFgJIFJC3MDgybg69eJYgo9FgE6GUg:IcEWCIqclgnY99zUg

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2