Extracted

• • Target

    Halk Bank.exe

  • Size

    1.1MB

  • MD5

    9d89bf38f44abe7199f4b7e34cebc254

  • SHA1

    eb48fb2f074aae30481beac7867794eb62cc383e

  • SHA256

    516b4492c4c76ba5d22f4e3867184816033a72712f7348f3d00d7903533fd7a3

  • SHA512

    345ac5d5b303253a2b42a366b9ece2fd0d5617bb6bd6b8cc4e26d4b9ffb5768d048c46723f35e0cd8dcd2bde3832245f515636b3d3b638aeba76d4332f743ddf

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCkGI07jkbxayssxXQo60Hr8L1:7JZoQrbTFZY1iaCBvnGLmh

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2