Extracted

• • Target

    45d964682ea37a0809803e813638017f_JaffaCakes118

  • Size

    947KB

  • MD5

    45d964682ea37a0809803e813638017f

  • SHA1

    9d6c3495865736235e55d8384832e9f09cb70896

  • SHA256

    b7ee1c6ebcc9675e5e1e3743b03a712c5e789f9b456275c05b35502bea6131e6

  • SHA512

    e4b2d060dd4066534cc6c8e726f7e41e637ad6a0203dc36c59d75eb136a366695adcbe363eb8627e4df46f659821d6fea85995c28686dd2453aa14ba4a727356

  • SSDEEP

    12288:ZXQZnf1pZRNtMLHK7zMWM9IZoFhK5zM66MXo8QR8T+JqS25lsxW9gf+NLIRljvfm:efXTs9Ktl7Yf2SoPfsMdIR9h

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2