Extracted

• • Target

    JaffaCakes118_0e710d4e75a575f78174ee6c79f8e19f

  • Size

    760KB

  • MD5

    0e710d4e75a575f78174ee6c79f8e19f

  • SHA1

    60abc2263d9490cdd2e11e667ba9c7a427474701

  • SHA256

    6ea9a9fa59a23241409f055e0fd5e0271667cc1eaac17ee691459a9b6139bc9b

  • SHA512

    5123eca528627481e1afe17d5628e72bd35b12ae68596b8569bd94f472db02edeb0c1e7792f8193cf6e2ff99a9988b3b8a046def943cc8bfaf7346ebe7856abf

  • SSDEEP

    1536:nnF9mcAT8tEWiTdDPaoXh8bXUcDroDlRplDsscMyb1DBZuBJGAfZxdlOEonOsLJB:r

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2