Extracted

• • Target
    Halkbank_Ekstre_20191102_073809_405251-PDF.exe
  • Size 623KB
  • SHA256 dd9b460fcb30009b31df7cafc33c7a3d4b058b2841bf34a4322f1724db932c5f
  • MD5 46e2a1a1fa56e5c02b850db88433b3c0
  • SHA1 9d5ce1eb5ec0c323d4c70afecfa133a0269c8f44
  • SHA512 6fbaa57c5715d6a6b261b4871802036399be58d257594c54990fa6d008f183448d024ae77b1f49ff8170a07b72e3d98d783d2c380e372159d7d5b2784b61b73e
  • SSDEEP 6144:kYa6bkeH47rrXImnUVAFNR5wqCnT4/hny6+fBMx5knCLz0B:kY+L7fUVS0qu8xL++HwCH0B
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2