Extracted

• • Target

    SOA PAYMENT.vbe

  • Size

    12KB

  • MD5

    fbd428b36af66d92efc3d5b745bd0027

  • SHA1

    5861ff074403f6783fc2b7c75a9dbf0ce593c077

  • SHA256

    fee12dd38f4e7bddb43d88c548a49eca31bda69c74fe73eb65d04e53f00bf749

  • SHA512

    3f586ee2b17c786e64e1b0244824ead9334b81d6284b38f59f2fcce02fea96650315b66077f01297248ddb9d23d76f2d6d7731ebb8d7b8f212e2e463642eebef

  • SSDEEP

    192:vPcUXIssSUHci9rEi43NIr+MJXgu/ALk41LS8aF+OLLluK:sUXIsspep3NqJwuIo41vakOdT

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2