Extracted

Extracted

• • Target
    Dekont.exe
  • Size 928KB
  • SHA256 1203b91790fca9a278e54674db530c661f7f6a1e885e2844e9811e1b5c07d66d
  • MD5 1e69c9a58d6be0b71a5e12425f79e66e
  • SHA1 bda73d3d6cd2b5c9386e8048a08d2ff3db865a02
  • SHA512 89c59cc533d9807faaca0e471a7719b78a1340683331a85705ec1c531cb832339ebdcb9b65da585ab9c8d73ff3089f9ef436d546a1268c7549048db8f708ff06
  • SSDEEP 24576:hrj/Og3JCfQur+ThyrVyjQicLyhNKvydzVEgOHs9:h/PZCfaMTi+yDKKdzVEgMs
  • TLSH
    T17C152251FBCAEA22C3825BF40EB6D17A13348D9ED831E3578ED7DCE77089A112494762
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    Dekont.js
  • Size 69KB
  • SHA256 dd1b5e3dbe8d34cdc690099ef33e13c35ef1b7ce57871b0fc46a699065020f1b
  • MD5 4c82ecc11ae0e1849dfd604efd034deb
  • SHA1 ba7cce5645e5b5467862ca521af9c3f91b6260b9
  • SHA512 0df2398ed79396f7d4df084dc7355c0c60cf0e609a516f147404275703c3fac7bd945a314993589f52a0cc5944ab477e5c29ae4317a9309488f55310c282bc20
  • SSDEEP 1536:VPr2Q5G/3krA1blsQpFR3B3RwZONrjpWZV2K:xrcZSONvY
  • TLSH
    T1B4631155698274806376B77FB23B98E1E762072702821A17B83C78A0DFF1D19CEE1D79
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondarkcloudstealer

  • Family: DarkCloud

    An information stealer written in Visual Basic.

    stealerdarkcloud

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral3behavioral4