Extracted

• • Target

    HALKBANK.exe

  • Size

    1.9MB

  • MD5

    50c28ec3b4d36ef6d94c9ee44669d5c6

  • SHA1

    e1fa59975732f319ee3543721946c9bdbddcdd7d

  • SHA256

    8424b5a86327251f934d4e4526de3d48b942c0953a866f84de2d7bb19a5fbc04

  • SHA512

    f6bd95acce6103f8111f3b510c64de731733b0e5ccde6313ba55193667d22a0cc5f076672b25ea30fc58e50e164ab8149541dd0a79ece6e26c54d27272b6cdc1

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2