Extracted

• • Target

    JaffaCakes118_e22b8024f4fb0c06114745e0271f1ae0

  • Size

    490KB

  • MD5

    e22b8024f4fb0c06114745e0271f1ae0

  • SHA1

    e3c7de75f745bdaaf9e40ecfbbade2a237750acd

  • SHA256

    513172951ac03e30860d2450220a2e3369a503cd0e935a2a7128c0e86927832c

  • SHA512

    1d1409f4518b0d6880b42318f28872b5082d224debe91825e91ce7b312e0b74ddf62af9376258d7cafda4d2c6bc58320ec11bb2bedd755345fba7cc68f8adf44

  • SSDEEP

    12288:sMXNQHSSa7soZbai1U5q97TdfPOAtp1sra3cw:TXCSdai1U5Qfxp1yw

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2