Extracted

• • Target

    Halkbank,pdf.exe

  • Size

    845KB

  • MD5

    eb34442586cd975b248f9c5391399abe

  • SHA1

    f9ed2d85ea52fb89442fb62f3710d70461da87a3

  • SHA256

    86b07ab0bc47fe6d3436da9e06c413c7d4575057b0b4b25a7caf3595c4e1f38e

  • SHA512

    9734fdc26873760b11ac88dba9e095ae50fd1866a91167f6c8d0163ca1d565477f3e86d18576aa9b628218ca7be60bd57a1b516b85bc7ec22d31472c890dd341

  • SSDEEP

    12288:cVcIxQiC/ooGH1dvSJ4YSlnOLgTtTJX4F2lfO/Q7OPVRSWerc:cVcqMooGHTYSlnOLgT4F42/4OtYDrc

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2