Extracted

• • Target

    0075e2b83a486c72341ceaf957ff492b_JaffaCakes118

  • Size

    477KB

  • MD5

    0075e2b83a486c72341ceaf957ff492b

  • SHA1

    e9a04b0920daed3d690abda4d1462447fbc5cb47

  • SHA256

    949012a9d13acf5498d0efa6c65de0addd48848a43ad6947f4514a177d759e9f

  • SHA512

    7d838ced0eac81e87f4a527bff01a8a71492f87a9cfc92f2960cda21a496eecb047a191221b9bcefd41e470fbdf383d6655cf5ba1f4b6667c8abf6a242ee38e0

  • SSDEEP

    12288:scahoA/6p1NO+UAywNyetvN3hL6py7dJrmgJn:09/qtUl8yelN3hL6pav7

  Score

  10^/10

  agentteslacollectioncredential_accessdefense_evasiondiscoverykeyloggerpersistenceprivilege_escalationspywarestealertrojanevasionexecution

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2