Extracted

• • Target

    ebd09a6f7d0b227b72d5c4a4a67cc464_JaffaCakes118

  • Size

    815KB

  • MD5

    ebd09a6f7d0b227b72d5c4a4a67cc464

  • SHA1

    32440265b058a21947b939cb6e2943c9893cb888

  • SHA256

    1b8d3e355ad916bb3152fafcb6b508b8c4bcff4c654b682327af6d59dd281863

  • SHA512

    d3c197288957b32a5700974765403e7f18329f0786489b54aaa7e75095eca9fc77f926c3469914d7355c6b2663c97eb0c476f2235a3019f4e107f8c2810f24dd

  • SSDEEP

    24576:jYO0MNjWN9d70F6Pd07Mkma1D64sLiELV:/thS9aK6Akma1GR5

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2