Extracted

• • Target
    Dekont_20230221-GSS2023000000047-9CF60B44-44B8-47D6-B88D-0A060CA70289.exe
  • Size 514KB
  • SHA256 36b012ce5d49946e13199b08e3b41589b4eeb80e429628031d6aab90bb2804ae
  • MD5 81171a0c4fbe80b5f7bc9d41ee97b753
  • SHA1 0b7584836b43afad22e8e863b2827e7be6b27a1b
  • SHA512 abd290679554d99e221398588e43bb78d6e7aaa03a201a008614572298c25e3066b775ffc8871533a4299c1e2594b4c9748b168ea15804908908d48cfc224812
  • SSDEEP 12288:qYi8LodU2EEA7Znkj/tiDsJhDbCbQbJTvIN6:qYioh2Eoj/I4zIN6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2