Extracted

Extracted

• • Target
    Islem dekontunuz,PDF.com.exe
  • Size 755KB
  • SHA256 a1a9a1eb021b4358e6585bd24332ec331ab91973b4286eee6f82f778997bfc33
  • MD5 0dcfa83bc32f60d83428021a250188c8
  • SHA1 7ba29e7e52fcc373524e25ff25d3de41bb55e6cb
  • SHA512 e4d478298544bbf3788360353a76058da55cae3c6b93e0e64304743f2457b3c0828f847572ca05a5c4eb66391a31b11dd7c763ed26bf65bc6ef06e60f6dc007c
  • SSDEEP 12288:BNbrQ6Qcx6983rZVlISB7TnUu+jKd0NLaDZ8SDuq2+xaxBtH6D/:vfMYrZVF5TnuK05aDZBfTxQBtH6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agenttesladefense_evasiondiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies trusted root certificate store through registry

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2