Extracted

• • Target

    Dekont.exe

  • Size

    919KB

  • MD5

    08610765af509f3a4bf531199e1d11c0

  • SHA1

    ec6faba1eaea782f61a8efa86108843891b5cbaf

  • SHA256

    2b99095636ec250358f5abd47474a374de96f743fc2fadb89642401301e6b670

  • SHA512

    f54071ef9fe277056193ad95f17c57ac2a3a29a3f39c62d04a33e765621129f5ccea4831052af6a1838042afff54767085cff7c3dea5662e9ecf1dc51e3ba622

  • SSDEEP

    12288:QERc7aGSI6yjjHR86mjwjy1qv/ZHBYV5AwtpuZ6pWJtVqlVPVoLfk3zUlS:3YaGbLNnjy1q3ZHBCy6orqlVP8K

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2