Extracted

• • Target

    259fc1e0bdda287e77aafc32cb0f31f8_JaffaCakes118

  • Size

    1.2MB

  • MD5

    259fc1e0bdda287e77aafc32cb0f31f8

  • SHA1

    db7ffb437663ccf250a3a754eb3be7858c996b54

  • SHA256

    8a433dd716320992f912d3a373bf37dc263f2a2d46231b563246ef9e1a0a2f1c

  • SHA512

    e66420b53e69b7078d03075367c1ef7821d492e83a1e656d530c25a3b59b486b981a81b8e337789e181f3ccdf696bfd26f83d8c5ad9f17e3ddb9b988f1bb0fc4

  • SSDEEP

    24576:6j8/OcyawskdMNj1pTlev9yNQZIAZxgrrq:6YfhvmPsrO

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2