Extracted

• • Target
    hesaphareketi-01.pdf.exe
  • Size 858KB
  • SHA256 db152b2e9e1ddf585cd151dfc4cb25c02f1da1aba0a7053c0c1c89d714e4b83c
  • MD5 f83ab35bf379e722420498c43ab17866
  • SHA1 2907fe5d83ce97d4689c8c831b37bde965bd1ab0
  • SHA512 7449e1a75a995f6d1a8662610d363955c2234e06ce7948606d2ef6690d6985b2c34f38dc273f62039526543218c425941630632291abcb9a6a2905b9062dbca6
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2