Extracted

• • Target

    eca512d5289783f13b346958c0bca5d9_JaffaCakes118

  • Size

    1.4MB

  • MD5

    eca512d5289783f13b346958c0bca5d9

  • SHA1

    061f5375c5edd832c9d6e9dcfa0a8733e1295dd0

  • SHA256

    a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac

  • SHA512

    20dc0f2ef11432cf63350b182f01c668d206a583473643932e4d2656f8f9f1932385bf14abed862e26ccb3f3919a703aeb562cea4d490cd877ed052d88c307f7

  • SSDEEP

    24576:Wu6J33O0c+JY5UZ+XC0kGso6FaaXtJFq1IONEPmCFKzKMn8njT0CWY:4u0c++OCvkGs9Faa9vqmO0tE8YY

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops startup file

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2