Extracted

• • Target

    f8dcb65b454009ba6b476be734554418_JaffaCakes118

  • Size

    635KB

  • MD5

    f8dcb65b454009ba6b476be734554418

  • SHA1

    cb6040314dbbeda2d354cecbe922de717cfb3f8d

  • SHA256

    e17431ad6de18342227a9f66762fe58d98d2c563ff70702487374f2cdb784ab6

  • SHA512

    37e2729d8b625e43067386f635157ea98dd2dca9118c7017045cf2111f7a0481e5a0731eb6e5477151219323221be4f9cc0b08de76040536430bb8e4f75df52b

  • SSDEEP

    12288:Ap203crPe0z/UX44AYb1j3v617Wr7piXQB/dQU/BjVR2gF:i3crG0LilFb1mgrtKQBF/h2g

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2