Extracted

• • Target

    Karachaganak Gas Project Unit 4 (KGP).exe

  • Size

    1.2MB

  • MD5

    870627d582b51f98fa0121b0079981b6

  • SHA1

    600f85e2caddb36af617617605b5357b87ff9c21

  • SHA256

    bd3de02e97b1484955daace9cd74c656ce3ea4cd303767285102f78b980b9403

  • SHA512

    d34820f241789123332a3f7966ef73dc1293b2a8b41aaab426c7cf8f62efc3af5363a95c5b726a9854db799924d15deb042aba69a2ee2b0f7d155347717036af

  • SSDEEP

    24576:c5D1RHLc3PPwWYYIwcuL87Etqq6vOSpd57vwvN4j6Ii3Vke3M:c5BRH+nmy87jd57v243akF

  Score

  10^/10

  agentteslaevasionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2