Extracted

• • Target

    JaffaCakes118_57faa1a156fab64c67192d27e1fc8cea

  • Size

    760KB

  • MD5

    57faa1a156fab64c67192d27e1fc8cea

  • SHA1

    f4d0954794e034c57344d20538b57e177bb65f2d

  • SHA256

    00ab5df695004ea6a1a8c5c9a5bcea126b489b2908a5b7f8e2e89d34691e576e

  • SHA512

    62185d7ae6f4c848c3b016c79b5bbc3845e6f668bd5cbb934b659b9fb5e911a3d1cdc24b75987f9d42dae2fc4e1ec7a67fd1a068b00b8eee05eaa38bc87846b1

  • SSDEEP

    1536:Vb080El4u2pZchpb462daV0G/vzU098rp8uRSRMMCniizgEX1Nv/xJZtRzBjDNbd:8

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2