Extracted

• • Target

    1f3c90853c32b6f513d5e3a32f5a3718_JaffaCakes118

  • Size

    853KB

  • MD5

    1f3c90853c32b6f513d5e3a32f5a3718

  • SHA1

    f389727a96b6ff7b363cb1cc9688de29a6b78db1

  • SHA256

    40dae7eb9cde7a94d5e0dce7238d05cf5aea100c2e9f6eed8ed179c112ba7e9c

  • SHA512

    e2784ba53abb01e5101b369dd3731fd7bb40ad31a48a27fbae626abe44b389cfd68439f1e3a9a64b38d3a89b6363e0a6713ce49b11e98730700a93ae8720ab3c

  • SSDEEP

    12288:ncJm5oTAPlqAOUVvD9wPWPHDWqA1UBiUpBwam0nRN8xDOwjPkCfKr/ftNBWWMQB0:cJmGTANqAOUdzHiKKam0/8ri

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2