Extracted

• • Target

    JaffaCakes118_f5f12e1479c4d031f6461550fe6542f2

  • Size

    424KB

  • MD5

    f5f12e1479c4d031f6461550fe6542f2

  • SHA1

    ea683f5ef903f72d4e4d1c4db4ef0d6b3a0dcf3c

  • SHA256

    2050f7d01bf55e61996569160919ec0a3af7ee0e9ddb358034d13674e1b82003

  • SHA512

    e66952af0683e6b63d0c05fe7078a723f304668e487aae64bdb0f1a73f4002743d0913adb2652cef381fc7347b5f23db5dbedae110261b1e59e29be99b33e4e1

  • SSDEEP

    6144:p/qbTI011M/OTH9fpMij1oHnKXDib7UkWHvroOTuYfgfcV3740yBObNDZZSyWfjd:p/qb3Y/O1VKeCv8faYfh8ObNt0yg

  Score

  10^/10

  agentteslacollectiondiscoveryevasionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2