Extracted

• • Target

    da2b28ff7945825e56de25f06cdeae07_JaffaCakes118

  • Size

    1.0MB

  • MD5

    da2b28ff7945825e56de25f06cdeae07

  • SHA1

    6039230ca4a9844b94f894f0411d2fc2049dd3ea

  • SHA256

    213d438ca097826c2ef69d2fa9210cc760825f4be66460ab90bd31452e47c79a

  • SHA512

    21244ff4127b19f3f0aa873a4f2eb4dbfb9082c1e6bdfce843582aeb4a34063776d6e0ff0e3d67a7bf898f7fbac0648b7491f5e12f26aa138286e3926878c1ba

  • SSDEEP

    12288:CgTgwI1Ih2uPkWPC1YbHMYVMCcZvbyROa/6DOKFHm:MwIeFTMMMvml6rFH

  Score

  10^/10

  agenttesladiscoveryevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2