Extracted

• • Target

    b166aa2a2c84b79e22a1a34de175c993_JaffaCakes118

  • Size

    584KB

  • MD5

    b166aa2a2c84b79e22a1a34de175c993

  • SHA1

    32dfacc738e62d35d5651b4589d6d758e2af0fb2

  • SHA256

    42eb1a6bc500ffc15fa3d45d7ecef420edd0c23fabf5d7996638178e2916c6cb

  • SHA512

    d98e3fac5f5b08912fe688a6b4d1ea8298242489d88076cdee27aa3e399e9c35b2d8454f8559ca5cb2dda9681b1405a465014585af59d8ad13d7ddd88ce4abc0

  • SSDEEP

    12288:U93Y6nGE8zEsjBYAwnb4blCaYzBCCqomDRaftBeB3Z6kl2mO:83YHEmYTALYzBCCfVgO

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2