Extracted

• • Target

    af4f00409b3a2223e14874db6568bbed_JaffaCakes118

  • Size

    1.5MB

  • MD5

    af4f00409b3a2223e14874db6568bbed

  • SHA1

    de5339354e14a9a4559c98315f5727fb23edfd30

  • SHA256

    fd1811b11af257706b725b9f4689ea8244e948ae5d83ea78869d19a50ebc7b86

  • SHA512

    b93e44dbf3a1d44dc4961d107bb0fa1293f31f7f8d18e16d250556ca38f2125a940a9d21ca57cb083357b8ba2c8aabc631b656470ed204cd8d3f89ee3ba025bd

  • SSDEEP

    24576:XfNvR/bgGlgKSaZX9/nlLS1rJwY+t7OZZS5R0:XFvR/bgGlgcv/nNSZJwppO3B

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2