Extracted

• • Target

    dbc24fc7e05e040b1e9841d0d0b7a3e8_JaffaCakes118

  • Size

    784KB

  • MD5

    dbc24fc7e05e040b1e9841d0d0b7a3e8

  • SHA1

    e905a4a50768f0ec4723a504928841a784ce88df

  • SHA256

    6241dbb3ab8453a01fe997b32e48cbc14345d714635f4559473c4221a68a62a9

  • SHA512

    c535aa7ba9d9e33ef438e7fdea18da8fa5ff465e424e2ee838f32bea390b35cf8ffaf6583b7a5d93431db882aa69545bd08249140319e540e72f548ae981e588

  • SSDEEP

    12288:H38ZC2jTIBwgM9poZThtKyx12lwLxog3rChBQhwIRP1z80Q8+ij5gSDu:XfzBw3PotKWR9h3On6t1Q0Q8fNgL

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2