Extracted

• • Target

    e459668689b4c45620e22ce13149eb3c_JaffaCakes118

  • Size

    416KB

  • MD5

    e459668689b4c45620e22ce13149eb3c

  • SHA1

    458ddbc339c57af84dbd3d5417e18ee0cc5c125f

  • SHA256

    cf68212c70f4ef3a6f698fe88c5e408c5c5a9865cfc5144be1ff0f448a581dff

  • SHA512

    bb83379ba9b387e53a182631fb2bdf9c8f5c14ec2ac61041d858d31085b42ab5b6ce2e69371dad05e2fbef05b13fd4fff22a1fda4ced6f1bfd8abf869a54e441

  • SSDEEP

    12288:jnESoaDL0jcPfRd/u5Glr+1yjj8MLqzQH:jnESDPAofRlI6j8TW

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2