Extracted

• • Target

    4dde15da019804bd621086db59c34c80_JaffaCakes118

  • Size

    904KB

  • MD5

    4dde15da019804bd621086db59c34c80

  • SHA1

    7335c3d82129641c5b94756cec5c174ef402afe9

  • SHA256

    8c7e7021e23663fc20eaa17a4a601c83922aaf4f4292f327f27a6f77b8fb6009

  • SHA512

    5a39db3d33ad32f641fa28e42ba55f32226294f07babeecc3b35bd7b27ae181be2a07922f246ea7fb4746526a481d0148483533d81210342f8044bc583638675

  • SSDEEP

    12288:6Xb28AjYAX9fhtoHK7z2QOY24b5EA3RLOG4rLsRwER68S0sBRRBGXgVx:mPw1h5KdY24FEJLsSERtlsnG6

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2