Extracted

• • Target

    SOA-Sep.exe

  • Size

    847KB

  • MD5

    4140a74da75f375f2b4151931b688c3e

  • SHA1

    1e7aa620f9e61c93357675eb9e15ee9c0a0d4fc0

  • SHA256

    21fb09c471f291503243aeac97db0e4522c1900b8daefb22e2ac3b0a2d5e80e4

  • SHA512

    49585fe8fe3cdd3261df07d4e1e7ccc6ed4c99dff30c8d6fc74e163a02610a1fe703a53882b5b01bd0c08275f124f8529744cde58c4bb0c8652e19597e34db70

  • SSDEEP

    12288:CN59USHKqby/ZWQLWMvU2a6ZwF/cqwjf8xJbJ1SLfqx0NeG99wCWIqr+nCggSFOM:CxMh1LWMvxxiJbsf2GXwaqipgSPP

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2