Extracted

• • Target

    SOA_Doc_1002205.exe

  • Size

    1.1MB

  • MD5

    30ee5aed8f77d9ce4dcb25caea725c9a

  • SHA1

    31bac1bab25c06fb44461f8bf7e78d6026fc0432

  • SHA256

    0135e5366b17a1a4b8c0d07d6784bb327c0ba2883ec8220e82903e910e94d597

  • SHA512

    b5060c1b8fbe9c1c4bbd58e82a2ce51e1c99a6484ca7f02bac869b0202602f4194db061c0414effc6ca1953a8fc24ad3d8a64fbb814233f34c3d6d506087ab17

  • SSDEEP

    24576:hh053QYI8yAiAtUFzI6XdYBd65LZ5Ep/CtJ3zbBgakmf:+QYIqiAtOLfEp/C/DNgad

  Score

  10^/10

  discoverypersistenceagentteslacredential_accesskeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2