Extracted

• • Target
    DUE SOA.exe
  • Size 40KB
  • SHA256 8c56bb12177a058ad85f8b445d4f7cdfb5bfcd21bdfb19a90ab21b56d6972b6a
  • MD5 3332620e6dfe3ac9aa2e57f04e37e4f8
  • SHA1 5bb832100fc937481340892247f155a7d18c15d9
  • SHA512 169ba7abf9dbca0b6a9bcbc40e1a8d7abaef88ee458160307fe150769317c2ebbd43c310d74737d6d47965f617ed4a96b5e740fc4e35c0fd104a60d9402af434
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2