Extracted

• • Target
    UPDATED SOA PDF.exe
  • Size 688KB
  • SHA256 40bb8b7b9fec345f4aa54b05cc02fa42b404b9de341e07f7c6d7a0c1a1d801ff
  • MD5 9ecea7ad4e7e70e51a106920267d20ce
  • SHA1 9cf8442d9a4496bbdbada0c29b853ca4838ddb56
  • SHA512 8193581ee7c9bca7273a50fcaa697ec0dfb5562df2d2c1d9194955b620955c049964da687d2f714ea4fc6e61837163c0fe73571646bd92cbcf2385745f653ada
  • SSDEEP 12288:RO+sn4lkfaSKcc+M7OCwZCeJmyUeGKPBhZipKqq7Q29bIut2sCJuv:ROH4SfrcNO8yUeka59EdXJuv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2