Extracted

• • Target

    3e9cbdad10ae0f941661905fc2423396_JaffaCakes118

  • Size

    524KB

  • MD5

    3e9cbdad10ae0f941661905fc2423396

  • SHA1

    1ec2dd0da20063288cda2f8a0cfa1d5fb11dd5fa

  • SHA256

    e71d1ee61ea4a286e2d9ccbee5f89aaf2b45ab93bf103377d699a5f9df2b67ca

  • SHA512

    128abe6075339f32330a0df2e5de9c7d08d62067a9948070e1762acd79679872f6a796741807ca6a24ff606b53a72886582130d5252d413b30aed46238dbbcaa

  • SSDEEP

    6144:+EM+0IxRd3+1fce8jJuklBSYv8NBTbv1Hy:FMU+Jce8jJuklBSYv8NBTbE

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2