Extracted

• • Target

    f9fec0800e972de6728cd47c067097a5_JaffaCakes118

  • Size

    323KB

  • MD5

    f9fec0800e972de6728cd47c067097a5

  • SHA1

    7c071b06729bb85313b426ae6c413aa612bc029a

  • SHA256

    cbf86dd376f5333537f8aa84a0942a077b137153595467095c9efefe760455a3

  • SHA512

    63b23fffdd134fe33c2093144d8c03c02134eccc7d38fb5d18ff43968fc615d1327acc72f386d4d0d429cc6d5dcc9e7a2ab090bffb73398e3581a3159b6c965e

  • SSDEEP

    6144:tvQYFGykEeF6I0hPWYCc858ugFD22uANEIJ3+0lQfz53Z5ESODG:tvQYF9LekI0dWYE8PNPJu0lQfySODG

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Modifies WinLogon for persistence

    persistence

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2