Extracted

• • Target

    fdcb53a86670d5782e0ac4c069537b00_JaffaCakes118

  • Size

    915KB

  • MD5

    fdcb53a86670d5782e0ac4c069537b00

  • SHA1

    36ddd04877b999473cf4e46b94f5330a559257cd

  • SHA256

    7566294be06c8142dd6574ef56767f90a424edb4b8a21058bf8aea868c9c3cc3

  • SHA512

    7c515e97f4ec22f0f103df8def0f934304a441149ffbac88adacf125873ce589282a1ae60e36dc5d6b8346ce369648d8883cce16dbd669bf115052357d288a49

  • SSDEEP

    12288:xur8TrIF6cjKY+0b2NY5CDPvb7HJTfon0IFR5xvGCzBGWNZ5vSy6M:AD6cjv+0b2NY5sZon0I71AE

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2