Extracted

• • Target
    AkbankSubeMevduatEkstre.pdf.exe
  • Size 1.5MB
  • SHA256 666140cb796c70ba0187af66f33a2b1b6932770a200a4b968288bf795d2a852d
  • MD5 012a65c50cf1cadafdd3ac7ae3f7a662
  • SHA1 03543a167f5948d6ffaee449ef0beacccafcbef2
  • SHA512 3b363281c778eb451c376248112ea116f5130e0fd40cc68459c9888c50ae628bcede0fcf75874a39e183cbd4ddc87cc919f57ca61466dc5b7f33e853d6e4d5cc
  • SSDEEP 24576:Xu6J33O0c+JY5UZ+XC0kGso6FamCbwCYwBTh4jI8His7EidWY:xu0c++OCvkGs9FamCsCYW6I8CsI7Y
  • TLSH
    T18165E02273DDC371CB669173BF6AB7016EBF38254630B85B2F980D7DA950162122D7A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdefense_evasiondiscoveryexecutionagentteslakeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • AgentTesla payload

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2