Extracted

• • Target

    hesaphareketi-015232024.SCR

  • Size

    321KB

  • MD5

    14f0b309c14c5f5e75c9a1d95967318b

  • SHA1

    baa09246339d936e19328dcca98c527a8af9cb5c

  • SHA256

    415dc24924ada536128e601b4372a72dd6d6e566e3b49c3c79a5b6dde7b702cf

  • SHA512

    7e8e8b92b9d3f55a105de154fdb1e468fa3e6bc73c21eef2495ba22ee0522e15dca490b1c1210b83ab2ed876f67c34efcde8ca72375a695ba69d9237ecaa5d30

  • SSDEEP

    6144:bJHFcDmiIr2baLQ+axLyAPuBthKaOUn1ajxPiFLUunarm5pL5Yzmwn3Wrgmi:hFKmX29+axg48gjxILLvpVE3tZ

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2