Extracted

• • Target

    e-dekont_html.exe

  • Size

    620KB

  • MD5

    c82c075375552caf61f526a379125a21

  • SHA1

    52ca0075bb3e8aefd8c614d6b1801b08e832e7b7

  • SHA256

    a84d6a658ddfea2bf155df47943d616f4dce09d55bf7abc2eac1f1485be7bb48

  • SHA512

    e7e516c74a23d65315b1ab62ea7b559cde29c4ee5b866bd8ab35844f535b55a1bf52ece8ec525152eadaef5333bfaab06e5898c24fda5e44539e88ce14a8d951

  • SSDEEP

    12288:/AfDuHOXq2o6dQ0kGSI8qUfSpcgYKhLURBX+3g2wN/axkOUWahznI9l8tj70:/gU2fS0q9qpc5UUTXVmxbUWa30

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2