Extracted

Extracted

• • Target
    Fiyat Teklifi_Yilmaziselbiseleri scan-10523 2024935164- BUET 07.exe
  • Size 747KB
  • SHA256 28cc41b32461784fcf2bcb6d66d4ad44cdf10edd2dd8d2b2712e901d1d44ce99
  • MD5 a385a5a1436f7b9f999ac40c6b681b79
  • SHA1 574d1a14633fcc55b83b0e6a3a1e9532298fc30c
  • SHA512 10ed1e3203b6bb1a93581d261636df2d8f20fa9425f2d951b748623bd1c0b4fbe74816e3fed5a24c84be88846eb010d8294854ecac360fbb3cde98a0c2c2e32b
  • SSDEEP 12288:uhf2iNT/SHb2U+WQXulefP6MTOZzWFgTd5KAqT/ciWnZWFM2//wrG0ePPV:u11cHb2U7fyVOZSE5DqrciWnZi//wrG1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2