Extracted

• • Target

    JaffaCakes118_5e4930b37a31c65525ec4e308a67fb7e

  • Size

    705KB

  • MD5

    5e4930b37a31c65525ec4e308a67fb7e

  • SHA1

    c598d2e034dd4d1e1266b8d0f047cfd629b56ab9

  • SHA256

    a96249e0df2c88e2e047ad332ba7d2755dd6f390d39afc67de05ddfa8726e53f

  • SHA512

    86600dfb132d057a6f7fe4d644b8c3577ef83ed95e2986d4c2d3475c6af92db1eb7bb3ef6288b29b441e30443057c296838bb49e1980e0ed7dfafdff7a6968e4

  • SSDEEP

    12288:uSqbw0ydlJVJdN3YTgVbyONZIBuYJgKuONF+5SGZTt+0H3eHw06a+y/oozUWCdE5:/pPCTlONEu0ruOq6w3wj

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2