Extracted

• • Target

    e-dekont_html.exe

  • Size

    652KB

  • MD5

    cde7c1f79b8159ab607119c438fe119f

  • SHA1

    435013ae5ba8fc9ee9948255b537512f0c9ba6b2

  • SHA256

    ed4b9afcb717295f5fb71bcc6f408dbbed12c6858ee2f20a1f7bd2ab72074fc6

  • SHA512

    f5d68ac386c6f1eb822a5bbea62c71e9c1345693ddf8971809f592e6544066eca552e57a642cc194b3e1181272d9107b62927b6ffe3311ce3de4646e63145031

  • SSDEEP

    12288:BY6v5DlZnhAkWsPpibPmLq5iKtwI17fZxtmkII5S5//kQfj6FiwyPA:/hHnqkWcpEmLcth1LZx2US/M0mFPsA

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2