Extracted

• • Target

    JaffaCakes118_9f7e59995263b92231ca69911bc9d20e

  • Size

    594KB

  • MD5

    9f7e59995263b92231ca69911bc9d20e

  • SHA1

    a79d7e3f0a49ec5324d8631d41f46a833d3a520e

  • SHA256

    3e8eb7a331ed3b1699d2138aecfa519cb744b9eccb52909420d3d3bed9a3ca05

  • SHA512

    b9a1c3d87ad255ec7baa65665ac1b6004a737f0e411b89d38b8f8a796bbc9b882010fed2b4fec5b5b39f49dfc65718caafdcf569030d04d971631617c5a179e8

  • SSDEEP

    6144:Gp9XAMEvBvp5ie1c89k3er+oheF8kYrQHoL43kEaVteaIHrcq7WrBlmQM7VQysgd:U8Zvmgc8y3ntYMI6kE6teaq7EBlmZ1J

  Score

  10^/10

  agentteslacollectiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2