Extracted

• • Target
    SOA020423.exe
  • Size 708KB
  • SHA256 758abca83bd447ee9d858b6535a6e8afaa024ecdda39c8d9987cf8d9773ea5c4
  • MD5 26ab9141edd28239cc887588c4cb257b
  • SHA1 508ebc047ae86b42a712ffeca2fca5b0d6efd2a1
  • SHA512 74e817c2c0a7d44df689d96a9371891b32c9d677406d2bac59a035e4467674f07c7276248f06f9a7071475d8d233c0051f05462f9d52906e26b746acf55380f9
  • SSDEEP 12288:Lp0ni4IyN42hHLijRIoo1/gdTRa81CJ05HhRViu5hjUfvD+jC:Ly1LriOf/gdTRa81CJa1djU3L
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2