Extracted

• • Target

    45e6ff05665da4f3648e08628150f7f1_JaffaCakes118

  • Size

    720KB

  • MD5

    45e6ff05665da4f3648e08628150f7f1

  • SHA1

    fbf09cf12b49898388445d1e8f40a47d2373a4f6

  • SHA256

    b7658612c080e27a2e17e20cff2fa72616d8855f0bd0ab85af9cf4605d54255b

  • SHA512

    5c8d8d7b5a1438549cfa880d2d6eed06a1e3d8fe90c5474b41a881e268dd576b86cc8a5939ec590e52d77beb521314e774c2dbf22eda842c9f489ef81ca301c1

  • SSDEEP

    12288:rZ8eJsPAXDbwsUP3gwKZFdUsR1vbBIKKA3NMFTY++Tq0cmD4VHfQe6ZyWshg+qb7:OPWUP3+UsvlIKKAdMFs++D4VHfQe6ZyG

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2