Extracted

• • Target

    eddfc5c0d54df839168961eca8eac04b_JaffaCakes118

  • Size

    766KB

  • MD5

    eddfc5c0d54df839168961eca8eac04b

  • SHA1

    a9e4cf4442241da6cfe70c64a396dabcdb365aef

  • SHA256

    86cdc28aa7b220cdf21710c3be636e7cb5f1dbb57b9dd27048113a02883ef9c8

  • SHA512

    5711a3b2ef519a562b930560a697e667301389644f3f7b308eefa827a54b0daeb5525c3290547f3092cbabbadcd294ee721100b64007ac9aa2e44bcf9e30f760

  • SSDEEP

    12288:kOLVE2/mYsY0GxRh7pHqKju+hltPxCT6fzBdEENo8RTzqN6W05N5wCauEii1B2jJ:ksVE2/mYsmJ7pKKyeltPxC+fzor8RTzt

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2