Extracted

Extracted

• • Target
    UPDATED SOA.exe
  • Size 530KB
  • SHA256 96e9d75deb3a39e567d00b705294f539b90f50540afca9ae3bf683ae2f8d2741
  • MD5 cfe2db295f18a121ddfa51b924ae06c0
  • SHA1 5bca9d8d4e817543bb8f04b63a57d531976ea0f9
  • SHA512 1f6d951bd6b5726abbb2e84febd5ab5bb2fd6dbab9ae8b447d80d0bff2e42e1e25669ebd167362897e91514754335a0d07bf7252d109a2c3b50b16240d95621d
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2