Extracted

• • Target

    SOA.exe

  • Size

    512KB

  • MD5

    5fbde32f923edf89d89dcab60b07fd86

  • SHA1

    dfdd545ca3b31bf3d74bfa1598ffb2bbac987dd0

  • SHA256

    e6b35b0c81fbe9a13602d49d28b382c697263672a937486910073fcb54e3b1b0

  • SHA512

    45cdf0fce3f266355530157a3b61d6855810be83ac455be456a57bc3b8a2ddc684fd3862c3ba7ee82ffc34bed004b779060b21905e4386c5fa3ecf631e38a9e6

  • SSDEEP

    12288:mySBeyYq6YFBpaIq8kA6UItMjk/l8tIR:wBdYZYFBvJkA6HIMD

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    attachment-2

  • Size

    101KB

  • MD5

    dcb89f3660b9a7305495f1ea42e89fb0

  • SHA1

    daf65f0490af6a6071359db80a0ec93589e527c4

  • SHA256

    e2da2376f47acb3ec99e8f0e63884ea0959fb837c6c216cacceae57a5ec50766

  • SHA512

    43559b526c805280579a11e629583ff674031177290a19d76b9117cfbd6b2fdcbe9c36247c05fea48dd7b7f49c786d0a1bc4dedd7764207110d392db1afd0b8d

  • SSDEEP

    1536:8IQn2jSupcFJVdgdmSB38zNF1bR8ZtOYIIHiW+XyPyJSkb6MR2Sy:8WjSupQJm3m98Z7JPyMkb6MsSy

  Score

  1^/10
  behavioral3behavioral4