Extracted

• • Target

    JaffaCakes118_3287ea0611a99696127d6412b3b30d71

  • Size

    436KB

  • MD5

    3287ea0611a99696127d6412b3b30d71

  • SHA1

    8df36628bca0e17eb876a29063f01cc9ef33d596

  • SHA256

    c4f52f084ead43c02434a0cc01589b1ff470e57b5d67e1a551569f670f4283d9

  • SHA512

    31d99f27b11e561e2874ff5cc2536bbe7d4e2a1c0e7ee9ffec6f049f52925d90b27042f38fbaad5653f918276148f0b4e1a6333fa579f40a627faefe449289ac

  • SSDEEP

    6144:n1sDKdwpygrVDVtkoaV5gjVMCATZTO3L+nbU3xeJfU7/zS2KzYt1PYK:pdwp9VDVt/ECATZTO3LubU3IM7S2RQ

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2