Extracted

• • Target

    f2a05386e5d5ad4ad30631fc7006d923_JaffaCakes118

  • Size

    857KB

  • MD5

    f2a05386e5d5ad4ad30631fc7006d923

  • SHA1

    d074dcfee8e47dbcbb28d0f7a61a866a8c1e59e2

  • SHA256

    fbfc60ce3fe47059c5b6eae9a8f20872e16d4697873853f4f224f042f321d042

  • SHA512

    9d4a8e32a7f789e8f99f15ad8629f20e9ab67c9dbe528c5eb1d25645e299f347be33b3f57b5c7da49454488997220d23c216e8167a738e585ebd0b5e6ba981d3

  • SSDEEP

    24576:7yBnjP6+UFJcYqnAeCD4EfYNM876tLjhRCV:uiJQVCBQNpczCV

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2