Extracted

• • Target
    SOA.exe
  • Size 599KB
  • SHA256 6da250db07d57180aef37a2cb036940a5c9f533a14ab7b64ac05a4c494f04ca9
  • MD5 47914ae9cfa8f725e2a1fd8c5ad169da
  • SHA1 512c263a62081b8e146e1e610c2c908208c0794b
  • SHA512 f7e217f18426c294f112f01e570d2e3650d103a2c41df7f137e1695825c7aed1c45065476a52cd56342ae2455641e5a7e501301c220c9165a07980954e4c9408
  • SSDEEP 12288:sZyUE+UwQMMMDMMM1CU779nS4rXc6Q+7275JIQouCEsTt3eyAF8XD83U:yuMMMDMMM1C47jgFd7fyt3eBk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2