Extracted

• • Target

    138e54e47019834c5452dad0a28decc3_JaffaCakes118

  • Size

    942KB

  • MD5

    138e54e47019834c5452dad0a28decc3

  • SHA1

    08c4d4abdfd1bfb07fcd9d3ee007e188e14e3653

  • SHA256

    c89194184213a45a74e4e5faaeabff9324d89821b593ad2d03424bb6e16493a6

  • SHA512

    ac32d1f625909d1454ac30a8edb6a0e319d7c019e853b577c882eb4f033fc1a9bedf08a935c0570da70504ab5170540df004a138e5375639a796fd1d5a93060e

  • SSDEEP

    12288:MqrukKRNEKLgtavsUQYHW6Y7+upX4Gian27uvoBtNj7HS+qPjyu0GoQDXi5c/oHy:Trf8Eg3cL6qdz2VHpGOu43cnuKboM

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2