Extracted

• • Target

    Dekont.exe

  • Size

    360KB

  • MD5

    43a6fbc81795d3764adfe6ae93b1b6b0

  • SHA1

    3cca6cb011c7c6b4eab3941951248961b328f54b

  • SHA256

    b7c7c849a3caf9999aa15fbf355cf825c00709240fabcd390810847e1f06e719

  • SHA512

    e75db5fcc54677f080d7541033c3dca23bd06b7856007d4a4e1e8a875d29d23ea832ab0a80943ada7602f2c2ebbd85d8c333e607c94b2f13792b368e312080f5

  • SSDEEP

    6144:9T6jlGhWpyk0gZzUq26uY1MPp08dOmbe5WwcotKYCNnleMVBl93QlDFc:NIlGUpykm6HqBTdOmbewBkCzPl93QFc

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2