Extracted

• • Target

    227e526e84bc7e118b496cfee86ce4b7_JaffaCakes118

  • Size

    1.4MB

  • MD5

    227e526e84bc7e118b496cfee86ce4b7

  • SHA1

    41aae57a7fc7398a88b880a14763107df6fa4131

  • SHA256

    68bdb87f19368095d755bf7a809c7c7dd8cc055815d368d142b9dbbcc9c35539

  • SHA512

    02344933b0f320a38aa3c3f8965610a18b84df172690e93a3bfb566320ca0ddda269cd07449d26d95c26680cc37f4329de53ac8e716ef8b8397024832b7ac89e

  • SSDEEP

    12288:3gqWIG2iNqqoViD1YNFXoQvTOsfOsPWWTcXWZQvJBAMDxZVZ5fYk:XG14MY5TOsGsPe3AM1b

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2