Extracted

Extracted

• • Target
    hesaphareketi_____.exe
  • Size 738KB
  • SHA256 07bf5e726ae6e3eb3d135dda4314a00b99d6470592da7c87ae186f5a745fb5d9
  • MD5 88bf8dfede5759cd4dde5cae816b9737
  • SHA1 d3be64bb0339c31c1878b1a3ff38b6a867408764
  • SHA512 7a54569f4c4f390be3c71eca5b8c776133de8531f0cdb622d04cbcca79af2eb75496584208b6c87912d0481f6b8a3724c3f7654d4d8ba9e1da742b61ae3303c7
  • SSDEEP 12288:SG6JNf+wUf1jArP2uz7VC+5N8cLibp+t5xej+ERgdjpOPszYpI8BLYSBlzyyvch:4JU18RC+5mcGICD2jkS+nBvyM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2