Extracted

• • Target
    TEKLİF.pdf_________________________________________.exe
  • Size 38.0MB
  • SHA256 778d492050c8870a1ac62d42f7b06aeaab1a5d044c0c52d0d2296c0669e4e34a
  • MD5 0b18bbb6428f85121bcf7c5edc7fd2d5
  • SHA1 5f68802fb882f23ae9efddfb164aa9e3e5c5496a
  • SHA512 07d656347cc25c65fdfa7d667a212d79aad6a75ac0dc8a3cc1abb1f909f026bba6bffe486a546472b72d142fe2d584d11027f6d38cbc865e449afd971825aa52
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2