Extracted

• • Target
    Ziraat Bankas1 Swift Mesaji1_20200604-4A83-4C11-A410-FDF7C81DDA9E.exe
  • Size 1.5MB
  • SHA256 7e08e758f9ab52f92fb38a7d7f114ea84df6804105def422feadb8f631a6c8af
  • MD5 0de544dd5f939e59eabffd06a71649b4
  • SHA1 e02f976a13e1a5e08833fe93e34f93137faf0bfb
  • SHA512 1b3f8b0eb06185b717910243fbf932dd5bba5cae2e8fe35a55731c86af5b9d8b4a5ac1e33182ea095bef25e1f8b4b69dbd582ed7ca4d5c77a17ad4f623087d63
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2