Extracted

• • Target

    f830db1a5928b263f4c2d85177d5ccd0_JaffaCakes118

  • Size

    996KB

  • MD5

    f830db1a5928b263f4c2d85177d5ccd0

  • SHA1

    96c132c104791b92d244aec47978231fefd0a462

  • SHA256

    b7100d4e869329857f90ba16e477f2c4c48c5727d22fbbe1527000e99c447ece

  • SHA512

    91344f6e3bc466ba37f6814d35b1011954f826f3e48b851c860e9dd4156ece35e3f7ee2b63c7c0ac96944c29741b319f73bd4f5e5bd3699c57073692bef10b89

  • SSDEEP

    12288:liGONYctrVs++Tt2OPWIIsM2A5JxOQqCycYqVhgnPSFYDVJ+ul:li7aMrVaTt2OPWRsPA/o2hgVDV

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2