Extracted

• • Target

    Dekont Para Transferi Bilgilendirmesi.exe

  • Size

    721KB

  • MD5

    4bcbd21fd84d7e8dc54aac25a98af859

  • SHA1

    51e15f254ed48918481f5f41bf13827607b234e3

  • SHA256

    b8896f83c476a5ed9b16d119b9d585e7f38a736330dde02a791dc299ebb64606

  • SHA512

    1d730a30fcc98aeeb110641ff64f9b3b57c11e2b46ba343bbac6b34349ba504c00c015ceaf2141f76f987f0f515e5d918b1903a0b19ed20eff16e28314bd0f87

  • SSDEEP

    12288:BF5nF8ME6jD/dIlOyAgJK7+wMisVjk61mhbJYiDmBUMdUk8PBL:BFPtD/2OjUi8kmmFdmuk85L

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2