Extracted

• • Target

    Yeni siparis listesi12042023.exe

  • Size

    226KB

  • MD5

    ecb9dc6ebe7fc72219f57876c166f4f1

  • SHA1

    ffcd4db15cc11f2d49eed7d4c0252a7f8c41dc53

  • SHA256

    df365b7013189762793dea193eb030ae8f7aed6ca14b5552ffd63a43508cbc6e

  • SHA512

    5008f49fe2e8544091f853661bf23d3ed61a10d2a84de3270f1ca32e9da2fbd5d25f2d77ce3f5141614e7626bb2eec8fde17f63c21490becbb44a9ac52445789

  • SSDEEP

    6144:NkG7hGpzhjfajfVUJLougeFU0J9/41mI:n7Mpz66LSXm/41mI

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2