Extracted

Extracted

• • Target
    hesaphareketi-.exe
  • Size 601KB
  • SHA256 ce51bc85fa9cf4a581de693c5901e0c03fff712c40f723009e393bad1a18d014
  • MD5 d8aa0c3eaed283b8d78298748900f395
  • SHA1 9899cc61cb992dcfe49a04f4a4209852713b4ab5
  • SHA512 34f42b761dd7a8774f628bb43d50c75202262518dcbad01d23fccb3323621852895f6fb1102af16f3e7863b13a6cef295f0b00ca987e1f885cdeba196a974944
  • SSDEEP 12288:662o7fX9fXw9/DFmZOfBXZfg86lIEd12cE/hSXpjfVtXhI6:nL9fAJ5SOfBpfz+IeM/hCJxI6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2