Extracted

• • Target

    e-dekont_html.exe

  • Size

    594KB

  • MD5

    d09175441808082ab8a05d0af0128450

  • SHA1

    a1ea7ac8c9d4ae1da6fd5df14d4e6cf3fc6bfae0

  • SHA256

    8f49069af492e2a87edd3a35aafec61b4640c7759917252d317eced01bfbe25f

  • SHA512

    8d4b7dde44292d12a208d59f08c7e0aa0845708be046490c04264e00f2732ea145a122fe3ffc198e3521dfe7ca632c7258ca465cf84466b1e449604de39d38a5

  • SSDEEP

    12288:ThNh6sxTA6qNhVLUS2pktzLtuov29L98kseXOSfTpaxtFJUDoh:TDDxs6g2pozBRv2skPHfTpaxtFJUDo

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2