Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Invoice 4907856.exe
-
Size
598KB
-
Sample
200707-g6xj8a8xve
-
MD5
cfe01269c178fea11b28130dd457c43e
-
SHA1
589c257ca5f0be53af4160bbd67c6a4dd01c8ae6
-
SHA256
40cf3214cd412e73955af3a64b3e61691ec44f3ee6bd8031ea37e69dce07b393
-
SHA512
7077c264debdbc5aa67e5d183eeaeb827360ecd886cce8bb24a7d93733bb33fad392dff3d2aa5a8854d9ecef70cde94510504e9eed7a5c8bb2d5145763374087
Static task
static1
Behavioral task
behavioral1
Sample
Invoice 4907856.exe
Resource
win7
Behavioral task
behavioral2
Sample
Invoice 4907856.exe
Resource
win10v200430
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
[email protected] - Password:
coronavirus2020
Targets
-
-
Target
Invoice 4907856.exe
-
Size
598KB
-
MD5
cfe01269c178fea11b28130dd457c43e
-
SHA1
589c257ca5f0be53af4160bbd67c6a4dd01c8ae6
-
SHA256
40cf3214cd412e73955af3a64b3e61691ec44f3ee6bd8031ea37e69dce07b393
-
SHA512
7077c264debdbc5aa67e5d183eeaeb827360ecd886cce8bb24a7d93733bb33fad392dff3d2aa5a8854d9ecef70cde94510504e9eed7a5c8bb2d5145763374087
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-