Extracted

Extracted

• • Target
    Ödeme onay makbuzu.exe
  • Size 656KB
  • SHA256 800c11ad02fd86a237e66837e9e3e9654f22affee4e325c9fdcdf12d0f1563d3
  • MD5 2593c801486095c9eab69fb83062f268
  • SHA1 2c4398f97e988e508f5dfe53ef8b90db2b3b21a5
  • SHA512 07fb6267b879b4b0e76ba7ceb9e39e6655208a6c9dad456df74e6ec9f1ffb68c3d967026fdfb58319b78cf2a992c03a825aca24fbdd413483ce578b22398e76e
  • SSDEEP 12288:6i4ObP3ibSgERCPcJsXP2wd9GjL7zVChlYZoGyZqPaRtC:6i4ObfkSTomLAhWZoGOqD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2