Extracted

• • Target

    f12da21fcec70f5f7e7b35198259a88f_JaffaCakes118

  • Size

    569KB

  • MD5

    f12da21fcec70f5f7e7b35198259a88f

  • SHA1

    04dfa1d27b34aed412ac2b799f4b01675767f8b9

  • SHA256

    195d2a0a39642615534776e0c4eaa04ad2ac825f077e51a0f7c9697af9eecb6d

  • SHA512

    987f6fa83e310b1aa26c61258b7354d8423b86afedd554c5763f9a1014e1df613f5a79dde094ed06082a67dcbec7b6632d9e2f4864d779cb846519ff966d0b1a

  • SSDEEP

    12288:zKCz/ZLpo1y90NxqACSV90vrA68dM4zUbY/nO0bfLohY:zKCzNpo1yWM9OivrB4IbYW0bfeY

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2