Extracted

• • Target
    Odeme 4805012 Projesi image 0001 png .exe
  • Size 646KB
  • SHA256 63dc6a0b3e1c7c4ac5f8ebc5e7b1c7bce6796b615e2ceba9402629224a965ec8
  • MD5 2b11954002fef0ba5a4f65d60683d7cd
  • SHA1 b8ee206aac5342d8fbbc89c19d0acfa7d464c379
  • SHA512 d03ba6c53a23eee918f27558940701cff0ebfb673b1b83674287fe610a4c8eef1e2b21e366c1e2803c5ba1e4b4a8f6b26e42bc3f381e64a20b87518c5e049373
  • SSDEEP 12288:kExEd6ysuFg+UkiFdtNP2KLbAedg8jGERWVFScf6TVItNKI2bkHCLt:kExcfsugkiFxP2W08i5Scf6TVuJQk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2