Extracted

• • Target

    Para Transferi Bilgilendirmesi-Dekont20230329.exe

  • Size

    445KB

  • MD5

    26c10e8edfe247965c0694415372ed0b

  • SHA1

    d07b6634339e0078362acd09ca06dc3d5c4e6be1

  • SHA256

    9e3890049c1d7270fe38d2b545a4923b8933d271f9f10d316a7c228e2b931250

  • SHA512

    4a9b7bd5f980084a1b8c9fac7d723c36abe1042292487fd3485cfdbcbce72cf8f3f9bac380ad45c30d328f89b58ab90e7ba647b7cc27856814ea64a9dd58ad41

  • SSDEEP

    6144:qBJoejY8WjxzbAvjvElb8xRNCOWshLXyD9TBwSp8oiMf5F2c0mtZ/BHZnmVnI:q7obSr8iGSLXyDxBwSu2v9tZ/9ZmVnI

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2