Extracted

Extracted

• • Target
    Halkbank002.exe
  • Size 735KB
  • SHA256 31974a19ae09f65adfb2b422558e32e598bf9b84ab6a37c58ffe9be073f29b5f
  • MD5 2ab72358b6a04a47e38b746467b97657
  • SHA1 3e8793381a99e2edf870dde3c91bb679bb50cc9c
  • SHA512 7a492b6b8582770b34fc3810736962d233e172b72fe49511af2ee71e0e61304bf9e5fcd4aea4425f1454053cb637378c1652781f581af9fc60325acd7fad5189
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2