Extracted

• • Target

    212db8e00740b88b4050c1153563ef80_JaffaCakes118

  • Size

    524KB

  • MD5

    212db8e00740b88b4050c1153563ef80

  • SHA1

    6712032d1f47cd8b3ad3aadefa3848ffe30b8c5f

  • SHA256

    f8ad810590cd3032267c077a8965e6ef50416f10d4755ab60ef441bb897e2e52

  • SHA512

    9bc58fe5445ec1dcea28ff5c5a743539479451c0e444e03dede059b7e3ff777f05be0690a3ff54965fd880599ad3a43312009417cc4e8f523c878d6f4f3f250b

  • SSDEEP

    3072:jvqEqvZHf+0MRde+ZHXYZ+7AYYdwVtv2Cu0dKebvKL35WGHc29Ar0tkdu:+EM+0MRdeEHXAFw+Cu8D76JWGH99Wdu

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2