Extracted

• • Target

    SOA.exe

  • Size

    19KB

  • MD5

    c707110b5d3e33f6931bb66320972fbf

  • SHA1

    c3bc71cca4af8ee4b8646d8bbe4bde5b5abe3cae

  • SHA256

    bd5bb196241d12eaa18a459c997daf76cca50aab22e5530e11f441e5e6047e2d

  • SHA512

    e910133c9caa1ee31555e59bfdcd2e01f007bde621e9a48da0b392e6db5f37932dcb2279537dbb5b39bbe9eaa77284a26bf9163e4505aacbb906cc97821356e0

  • SSDEEP

    384:BYVYVMIL/FQIIbE3rUPzZKF6wzbaZNHZVGmGovy8ZpHGH8X:sYVtL/fIMmzM6SbSN5PyiRl

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2