Extracted

Extracted

• • Target

    KNP10WS150RJB 5K.exe

  • Size

    812KB

  • MD5

    73c4d511b769f0869c87b5d4621f2a81

  • SHA1

    a8928f94fc09b95a019ca5cc4a7f3c0f89966684

  • SHA256

    e71a07f99b82d89d7dcd21041055ec628b6c8855af5f44f954354dee5fa6fb74

  • SHA512

    9d886ebccc71c4e060fafdcf2d736fea2ec391495935c20fa5542f2fb7ec045587cbe25f408f239be7616c6b027e7590ee5ee121306952514ed6e0586f39d8d4

  • SSDEEP

    24576:/34/up+pJBv8nNX2ohpy+1AphoGJLYQgll7Bq:/38PJ2NziyAphoGxYZl

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2