Extracted

• • Target

    029a668b833e8c2ed5d7e68feb6aafe2_JaffaCakes118

  • Size

    429KB

  • MD5

    029a668b833e8c2ed5d7e68feb6aafe2

  • SHA1

    f8d50fd96b6e84645eb7fabd32440b06a4ad9518

  • SHA256

    85e3e0df304bc9aa1bf1aab6c2fa0b9141aa2830699087b4edf2bffc06367f9d

  • SHA512

    7aae7b995d964a97d4bf85f7b602fd11e69eea3669f8f389e0d448f11e305e42a228ad8d56f90cdea5e0f1a8f06940fc198265083ad4444e5de8a47b93385f9c

  • SSDEEP

    6144:tga6NXlEUA+RVGcU78+y1gutr257K4kMd1TMg1KQwvCQgmVn/q/kZEAmg+:ia6FlEh+aptuR21JugdmVn/q/kZEAmD

  Score

  10^/10

  agentteslacollectiondiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2