Extracted

• • Target

    f6cb6eb02235981971620899d88aa337_JaffaCakes118

  • Size

    416KB

  • MD5

    f6cb6eb02235981971620899d88aa337

  • SHA1

    912eb370190e513ebb0a130bfd2782a4fc2661bc

  • SHA256

    8b334c052aa35c751a90affd750f2f0522fe23c68ae332cce60d4c1337a61261

  • SHA512

    98cfda3bb8c3bc3c98ff3e577076212e2cc5c3b7379b73a1596bf00371ce5712ecd72e6986d6c67fe89db7adba51c6608c3b86473ec8a6336eda4520776cd50f

  • SSDEEP

    6144:GA3TDL3TqokDj/ZyqigHv8qXwuTdJPCRIhlIJl5gAI8OCYrNRaq9qh+3tLglf:GSXkAqiOvKpRPJfgJVCK9glf

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops startup file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2