Extracted

Extracted

• • Target

    hesaphareketi-01.exe

  • Size

    1017KB

  • MD5

    81f454084bb8ee498f680d9eaed25850

  • SHA1

    dd763d26044a9e6672281131768405ba25643346

  • SHA256

    4a1731baffae0aeb7576bbe744f7c4bec60f3a8865fb6f9ed597f50f6c9e4c09

  • SHA512

    cd32c30ef31b496f717249de4782fb860761891480863591d86e29e5b407544dfe64ec3d9b4ec0818414c4a89bc4b7b1b7b4dbf315eda1093a9d814417cc5395

  • SSDEEP

    12288:GiVlj3F2Kt6YepVYKi5qUFxMwna156ZG5M+McgRfwfzouhYm9jW:hIpm5H3nZwxdg9wbPh996

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2