Extracted

Extracted

• • Target
    DEKONT-05-02-2024PDF.exe
  • Size 809KB
  • SHA256 f0a114654cba048408e9f71cf96233df16bde54f00041909567761bc5eb4e38e
  • MD5 8ac362d656176ee0f1fb82378343f044
  • SHA1 9b0a8f78365d9ca541bfed4e3965a192c8edd854
  • SHA512 c4f406097ea5f1e7817db377d6a6a37db73e5d9e65feec930a92d3fc30435fd4651b7d38d6aa3dc8de071925af890aa2fe0978f492cf5e4b304a24129987d6ee
  • SSDEEP 12288:GpCrAaXYykD9c3hO4qfKgCWdlrTaAhTTd1tW/+o2ZuWvYnW/xUd9hX9CrJ+a2:GpGIr9cx58BLlrTh+/+oUuTnWo9Cc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2