Extracted

Extracted

• • Target
    hesaphareketi_25_03_2025_20kkb pdf________________________________________________________________________pdf__.exe
  • Size 715KB
  • SHA256 91c190f0d3c633e5cf959e992ddca4509b022aea53772030e510dfea69a7342b
  • MD5 a724e44288952fb56c7810b2b242bb56
  • SHA1 15cc04b578adf64f349e3b3feedc260a68da2b12
  • SHA512 cb97a09ff1f57047e7c6a5967a4d27d1e34460cd064ef4a2fb14063f6afa65d762a4cece03ebfb12272c3485a9aaa032c5d0a26746ee6f1a39b047feba87b71c
  • SSDEEP 12288:tde2YyOn6nzxJmIXZV4D/YEwcOB87RbuOmAjbycC2nNHQv9HVKTLjq:fY9n6nfppV4Wcy87V7mmhxwvC/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2