Extracted

• • Target

    e195f4b393107d92d56da2a2c9881567_JaffaCakes118

  • Size

    1.2MB

  • MD5

    e195f4b393107d92d56da2a2c9881567

  • SHA1

    f1030e939e3436801bd884f0d3057d0375808c44

  • SHA256

    991ee05457120e50152eb9a32891d6783ae6aaaa6c2f4a3753da2215077b0f00

  • SHA512

    9901c809c8f3171c2470e32b40ae92a8d7af4ab21acf6c3fd6f0bb19f7bc1474872f0627fc4f788bc1e6c9e0700b20265d27e4ca2d86d905e5b447318aaafb5f

  • SSDEEP

    12288:YVHjzZizJgzPFUDPFj6jRPLjRPqjBjjyjBjBjBjBjLjsYb4L73rtaXdi2DCA18je:6jzZNCDni4L7wXY2Gymj98501kYMD

  Score

  10^/10

  agenttesladiscoveryevasionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2