Overview

overview

10

Static

static

10

Dekont.exe

windows7_x64

10

Dekont.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b4b81dab904dd9ffd8d9b07d9e42c16631aa34b7881f85bffb3b7246521fd1a0

  • Size

    321KB

  • Sample

    220520-3ytytacfbn

  • MD5

    17b64411ee6f3c407d967f2abc404baf

  • SHA1

    d3717ffb659b28ff00d8e6439262b3f566e20d9c

  • SHA256

    b4b81dab904dd9ffd8d9b07d9e42c16631aa34b7881f85bffb3b7246521fd1a0

  • SHA512

    ae8b14efd92b4d338904f1938d69dc36591e58daac0b256d0a6c43a2dafacff6fb9aa6cddf0187ac0619d165489cf1c7b9602cd0ed94f3324f512f78708a2af3

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      Dekont.exe

    • Size

      771KB

    • MD5

      e6e0c9a9a19145589f731d7380544b97

    • SHA1

      16c015e77df27881bfd08e50a2e1257ddbec8503

    • SHA256

      8f560b247ad96f57de4e2f6da3d99af31a7ac8478e560c6fbfaa1d3615e65575

    • SHA512

      07ce4fd45b62a2a2fc07527c16b869fe86ab0c5081cbae77a79301d368b456a6607880d3a6d28adbc74f2a5c5f2c4f263eeb87f84e65e220c934d82fb952b31a

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks