Extracted

Extracted

• • Target
    Halkbank_Ekstre_20200527_080247_232393.pdf.exe
  • Size 398KB
  • SHA256 ea7084c6771d3582c0b95ef3cd3ce4e371cfcc7b41f358e8645e4bf4870fa2f2
  • MD5 99c93f716eed17f114c02ed2e193faf1
  • SHA1 f660c44f96be37b147fc9f4dc4eeff48c74b16b1
  • SHA512 3f754550095a7da74e4a83fcbfc2e91fa588d1503e1644be809ac6e62a9d120a4679ddbdcdf9bd1ac3a827909cd65abea81f0f1ca69272b5c3a93b208cf0dec3
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacoreentitykeyloggerrezer0spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • AgentTesla Payload

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2