Extracted

• • Target
    e-dekont20230228_061814_000076.exe
  • Size 501KB
  • SHA256 3672a8eb0dd83a097ffd82461ba28956fba31e179c80f3744bcdbd52a5b77121
  • MD5 6a00ac2de6900e9e4ed4d3f7786531c3
  • SHA1 9316c175d02b30c572727ff6b1721dbd9873715b
  • SHA512 7dc0272f3f81f5430d336b7f9882c00959ea099cea796cc8fc4894533dc7f174df5b08fef5da3bdb7ee6f3e8697e1e42131ed8ccdc622bde93b80bfba20c71d0
  • SSDEEP 6144:IYa6hQx8ayrbor/tTJMJWQ5AQNqFhomFh3CfYXVcJIUV9hUTRUWwJ51BRa:IY0xPgUr//MYBQ0m4C4nQnEOw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2