Extracted

Extracted

• • Target
    Halkbank_Ekstre.exe
  • Size 663KB
  • SHA256 3d006b91ab0c95d886dc7d54180b846596885fd53cf2c8d54e03fb5e8304776e
  • MD5 c0852e4365d4995b5e84a90453a69f36
  • SHA1 143f854ec4f163b4d057bb04e96ec09c09f345ec
  • SHA512 adadb5b380483cecad90d204db49257844255e7145a9e01561025958103a65c5bc5900adc9ab3e44fbe19864438264aca87bb772cf0e5a8641bdc68f2bff9738
  • SSDEEP 12288:HL/4/qYp1TgjDnXXQNgPLGkdXvdt1WMlu2mLPSBWd5C3mSEEZoIw:HTlC5gjDnXXOgDR13gSBWd5EXZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslazgratkeyloggerratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4