Extracted

• • Target

    Inv. & SOA.exe

  • Size

    881KB

  • MD5

    be042f209b58598fe1e6a1dd0069338f

  • SHA1

    e65ada8af54201b0251f105d56acd200ef1f6adc

  • SHA256

    9618f331b2bbad7bbb947cedaad7dd744169318cb11212e05089c6f4b8983400

  • SHA512

    4016a3f80ede87654c9571d3a070f9d6cfa25a0cc83d8c2fe227f0f18a82c821c0580aa82b844cfb079b69db404a3b3fc3808143b20e8a8f8e6f9f47f65a785e

  • SSDEEP

    12288:0n7hgpSrh2uh87xM2dnn4TktJXCTDW01RYcOrsj0T55C:CmAt2h7lx4TktJXoYcOrs

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2