Extracted

• • Target

    DEKONT.exe

  • Size

    99KB

  • MD5

    7f1f15a85427da202d74198b1cd039d9

  • SHA1

    ca883d37cb9e51c1b2cbeb8ab7a398f4f95df187

  • SHA256

    44fa04f2cb49eb5ee3d7c3d3dfafa2a53137f6e1dc8edf4b6c21d6c7af487e06

  • SHA512

    14a9658d4658aac38b18b6a2c6eb5be6c631099965b15dda7d0ae5aefb96093afc4c885cce7747da2fc9ad8e1ca8581a7a4d7bec838ea4cb23ca990108d94590

  • SSDEEP

    1536:dTuLU6Ez6NhN4ahmbtbJRmYUaNuquK630VD1:dT96Ez6Nz4ahmBV9UaNDEEVD1

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2