Extracted

• • Target
    SOA 20241224 - 2207.exe
  • Size 657KB
  • SHA256 a0cb4caaa0e12b44876ff4178904c97616cb752541c3cfceb1a501507710cea2
  • MD5 e9d7adee1ece193a4250a1b42165bece
  • SHA1 8eabecb064f848332f3cbaf5c32a34a4a96cf5b0
  • SHA512 37ff1821c05363a774b76faf68c6e80f3c62690f30a7500f942e65ea1466e341bca45cfcdbc06d4678f4662a43f72bc98fcf4c993de07054fc5664e20b71a703
  • SSDEEP 12288:6z7hU5I5yuNHIgzSFKxWltRohBfSTso93U/62WsaFrPDt54qzICLkYtO:6f+iN57Gtene3TsahPTVLkYc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Executes dropped EXE

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1