Extracted

• • Target

    Ziraat Bankasi Swift Mesaji5112023.exe

  • Size

    240KB

  • MD5

    3a9aad04b8678ded71759be00a443670

  • SHA1

    03527b0b9fcf28da63fbaa78eccbe766a932386c

  • SHA256

    6852337e03092bbeaf0cd61078b2e6fabc4e02df5aaf769cf133f30270f5cb4b

  • SHA512

    d663df282ee5c0a7992bcfaa757dfb6e1d9f798a0ee65f8bd2eb782e06c79c3d980f4a75ce78a3b1c59b8600e41fa430ed28c63a0fa4813396cce1acc3718a1f

  • SSDEEP

    6144:w6KXdOmb7/syMSnOYWNO8qmMo9ucII/Hn4:3IdOO7kOOftqcB

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2