Extracted

• • Target
    SOA MAY-JUNE 2026.JS
  • Size 4.7MB
  • SHA256 7ee1824c97fbb1ba69c907d552ebce6832a62f26dd4973112fc466fa2dff01f0
  • MD5 cee7443bf9b70094aedb48e4d3f63258
  • SHA1 5d92f31072844f583b837a9560848a1c783d2aef
  • SHA512 19cbb273c169407378f299e2aafce8259fa603d1500127d490ea0fc00187a2a1a97ae5ddbcbe6044a2c8dd6993dfca401a908361e59fcea242cecbae5561bc93
  • SSDEEP 98304:yG0HYgBXqDrQ5pZkiDGtdvJEr0RlUQEdq474flJW7JQvuKJF4ijHNzdRISdPhlum:Q4gRqQ5n1GtdS86q474flJW7JQvuKJFJ
  • TLSH
    T16D36094157D4A1777330E7AD523AEE78A40E900368DACF15349ED728392CD87AB18BE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2