Extracted

Extracted

• • Target

    e-dekont_html.scr.exe

  • Size

    1.0MB

  • MD5

    abc774f48c2e514bde4ba275a4314b4a

  • SHA1

    141d5d859afb0340302bd4ee2ca2be9493f39804

  • SHA256

    fad3e7058eb2fa88ce97e62a6a243748d6736f9c4e21e4112ed61a40813588b2

  • SHA512

    3d2158afab276197313827e33bf25302b623fbf69a48892fcceb69c50690bf6bf9e7047ab18870030259bdb34d9b3fa7a32552a6964698f354e03ae531978065

  • SSDEEP

    24576:kp7jSc9duaYoRV9ii5nHMAXJ2LiMOxckwle5O4i:sGc9VTntVXJKiu

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2