Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

15/07/2022, 09:29

220715-lgbmgaacf2 10

15/07/2022, 09:19

220715-lam2xsacc7 7

07/07/2020, 10:05

200707-ynncrekztj 10

General

  • Target

    Genauto order.exe

  • Size

    556KB

  • Sample

    200707-ynncrekztj

  • MD5

    7d88edcbb610c519bafff302f31b5221

  • SHA1

    bd95fbb0de8df563316a4559cee53a1bce1c97fb

  • SHA256

    f8e17a185cddadfc5bb32941edbb87428cc13c1d2244695f03a69ed511d9a8f5

  • SHA512

    0f0d5fe3c4a68337f764f8d5be96fb340400271aa783c9db268993e89c1d9d8867525cccff80df9aa7b1e610effbe4a2aaa1a3b6a6f54e00df04e7ba8817d3d9

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    cr*fDaW&m@2y6u

Targets

    • Target

      Genauto order.exe

    • Size

      556KB

    • MD5

      7d88edcbb610c519bafff302f31b5221

    • SHA1

      bd95fbb0de8df563316a4559cee53a1bce1c97fb

    • SHA256

      f8e17a185cddadfc5bb32941edbb87428cc13c1d2244695f03a69ed511d9a8f5

    • SHA512

      0f0d5fe3c4a68337f764f8d5be96fb340400271aa783c9db268993e89c1d9d8867525cccff80df9aa7b1e610effbe4a2aaa1a3b6a6f54e00df04e7ba8817d3d9

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v6

Tasks