Extracted

Extracted

• • Target
    Fiyat Teklifi Hk..exe
  • Size 709KB
  • SHA256 86caff3276f512d98f8551121b2a9c0fa2a4c40291569af16fc08cc14ff3dae2
  • MD5 815fcbec7e3f10ff6bc9cd6b207fdf28
  • SHA1 c48b01c0682fd99ae665a8cc6c801edca0d09e0a
  • SHA512 a2c620e4617771071b811140bae9013bbdeba80a93e9d5d7f7af2c8c4bba65fe43e5ad3c30ec33faf076732c985285c6f0fffe336541fcc280c7ec12e54ff033
  • SSDEEP 12288:yBtpI/jeZ7GdyrNereBvFs0N9zw7fdDslIlOpoJKCMTLeJNBD:CI/jeZ7NereB+CZwj9eOOpUK1vENB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2