Extracted

• • Target

    efba2f0fef43c9d866b89e8757e898bd_JaffaCakes118

  • Size

    583KB

  • MD5

    efba2f0fef43c9d866b89e8757e898bd

  • SHA1

    e10321ce870752b5a630c56461dc630a6b69a246

  • SHA256

    2ca4f8006b5eddcbf87895299660f90ff6bad708c5b4b5be93d4d430288216f1

  • SHA512

    dd36c21438e6c32e4104e30bf44e0462dab0fe598cb8e21576eca193758e3d04465f7f96d9d557f19a42306a2f1b49252899ea6aa42e7252df330054ed80e5d7

  • SSDEEP

    6144:iVL0nt7DmqF7f3WuBJweg1jtblBdrUGTHLR4XKKKMjDXXSR+AauJMwL0d:cuvf3WuBJylfXt4Xjjg+A6G0

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2