Extracted

• • Target

    SOA-Sep24.exe

  • Size

    811KB

  • MD5

    dec1aede826ff5b8ed6ae26778452996

  • SHA1

    da1cc5dec36cd44e8cdbdc01c52138776dd67a39

  • SHA256

    223b17b28b631da923ca472fc458645f286554be5032c7cf95ff6b8fce43b90e

  • SHA512

    e36126053604d7b09d38955601bf194153d862df7cfd43df0438397f586af60e321db19df2ceda4cd87713397abb330b34d78d86912e02e3d3527812a62a5031

  • SSDEEP

    12288:Qr4lwKEkWIIuVZ9dhnj+kLjpDpjaz1n4cvAj4FrqfabW/8nMYT4mE:WpKEkWKnBnj7+xvA4oaa/BcTE

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2