Extracted

• • Target

    Teklif Hk DGN A.S_20230214_902195153_699008811600000_pdf.exe

  • Size

    674KB

  • MD5

    d361e5fdf4232da920ed1a28bcb1ceae

  • SHA1

    c4b1df0365307f2e09036d23a5724dacfdd8e4ef

  • SHA256

    842f0c665fdc15b778d33347d736ef588e9d3e66de357341bdebdf80d6016f85

  • SHA512

    365b76751200eac94d89f933ccde1894e8304042e824d0d8fb4cab020ebfcac32e56499b2a7c61fa132141bd18a444ab2469142084a118e55425c0154459ad81

  • SSDEEP

    12288:HfWecesY+Uri/OaGd6aXleNeU7tJKNUO35oA8Jws+ozdzgAp+Y:fcesv4dVd6aAEAoUgmHws+oZg1Y

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2