Extracted

• • Target
    dekont ( 61).pdf Garanti BBVA scan00100.exe
  • Size 694KB
  • SHA256 2fe3221aa9dff870b2112bf96ed78c99ef06d99dedc3b103f061cced424c1cff
  • MD5 e65f0ecf4caf66f9cb642e94f921e99c
  • SHA1 849117c6343ec260a8032d2ac220cbfca21df9d7
  • SHA512 52b0eec4d9628606ae7f974f84f68ddde44fa3ce6d74ff5e54d7669ba865adcc615f37b650623b682572f9fc4bad7802783388c38dd2fc66c89ec9e4b47963e2
  • SSDEEP 12288:12N8jiZ4zypIPsJqtPplTY6RhKuXiqzbypncR2kZ61r4b2+Xj4e0bBThsw3KoJy:12N8jiZ4zypIPsJqJTDE8iqfypuES2+O
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2