Extracted

Extracted

• • Target
    fiyat 25.03.2024 ara alim_ unit order.exe
  • Size 710KB
  • SHA256 2f1acdeff407a2ddcc16a30e5524e07cc543d45e0df27cc0d6da3722f0f7c998
  • MD5 6a9b97d6916857f64d90084707de1e00
  • SHA1 d28f2fa2bd59bbaff092e752ce755220ed847405
  • SHA512 46e9f4672c111e1cf3c0eb4774059331209c157b976f5a7f3daf96151eb42d891ee33a2da20196783846635d1aaaa748f86053c0577fccc25b33503a47293539
  • SSDEEP 12288:s84CMwpreEndxfpO7jweeZzsuA2XVlmocKZ4gnTGOc3or5d57cMLX9cswmy1/A:dreAdppO7E7HXVXc/gnTGOv/SNh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2