Extracted

• • Target
    Akbank Hesap Özetiniz.exe
  • Size 484KB
  • SHA256 b36cdef1bf3b71c8edb27b1d2eabaa00b2df89f3a46bc9c727f4dbb6956fcddb
  • MD5 3b8a94165d2603343953e2491617f5d6
  • SHA1 7ba71a7d18927af204e086a8662a93df9e24ce46
  • SHA512 445557b0bad87c39ad63598b51e057ec86c67469ab83d46787dea5e66e0b84fcca313f44115e82a24918b533b00a9862c353ff315e5a17645319449dfdf076df
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacoreentitykeyloggerrezer0spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • AgentTesla Payload

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2