Extracted

• • Target

    YKBGunlukEkstre.exe

  • Size

    589KB

  • MD5

    f96afaf30344ea6b4ed09ea21eac6410

  • SHA1

    dcf60abd5b785ac987959186675f40e076bb4beb

  • SHA256

    d3044eda99fbe3e3207ea7841d08f34a8169acf445184fa4b5c43df473e0ecfb

  • SHA512

    44bf5b92f618ad6c45dfeddf8411f819b54bbed47927ab79fa8f76e3aab23fc4a3c5c3fe3fce504ed51dd91d9c3d039f0fd8fae2d01b6777a68b78963a882ff4

  • SSDEEP

    12288:iVnY/eZuzrspYw21ZNnROvmK7gT1V7TFtKeIhBfJP5oAoESEl32rumfWtxf:iVseZhYVROv2PChoESEphmet5

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2