Extracted

• • Target

    SOA.exe

  • Size

    856KB

  • MD5

    4d0e331deaa258bc549b39550d7b2d48

  • SHA1

    03869d19f359b1aa0c0574e08f943b131958b441

  • SHA256

    8428406eda6db55581a934d0ca6b892e5aeaad581174e907b02bcc8e48d6280f

  • SHA512

    e24a20baf4b2e798106e89329fd2b923c79139976d44bd3341ccdffdb4c4bb31bc39bd5db1ebb806d1c685cd0b77838c0983037159682db821afdb8fb28d0f9d

  • SSDEEP

    24576:6P0tj6tVhE8cqiuo6NTsB3hgwLvt/W32:6P0V6tVq4q69sB3hJ/82

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2