Extracted

• • Target

    157b0e9ca724857af7eb346cba94ab85_JaffaCakes118

  • Size

    524KB

  • MD5

    157b0e9ca724857af7eb346cba94ab85

  • SHA1

    9f34a6c259299860e7fa4cffd120d403e4a93e03

  • SHA256

    c013e2e7042bb9edb28a5b612acee9cf65d295e84c4ff1e2e0073db33b4511b6

  • SHA512

    048ad6e4014d760a7d2ddefbedc4913e923104441513df40d5b10ee19687201063e55b144ff37c8633a0f6b545bfd822da8d90c48676278855d720bad0982ade

  • SSDEEP

    6144:+EM+0RRdILiJUeCuZk7jgOgRK9D+nlNJieP/4NzGFp:FMILiJUeCuZYgvRK9D+nlNJieP/4N2

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2