Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
overdue account letter.exe
-
Size
791KB
-
Sample
200708-jltyw81v1a
-
MD5
70c16d0855088ef43d81656b47332bba
-
SHA1
9d1a98abed89859a96fdfa0d1e40ad4fc63601a3
-
SHA256
f51d5ea747751e28a14ea5c32a59d2b2af33bb91c402408312c1baa85054acb3
-
SHA512
2c22c630c6b3bc8b63339b6e143f4c98921f8bbf6a31673bf7b85cd49789f2412dc067c2ec03a1c05a55b273468be354d2181353e151475b1c5e4388599e0596
Static task
static1
Behavioral task
behavioral1
Sample
overdue account letter.exe
Resource
win7
Behavioral task
behavioral2
Sample
overdue account letter.exe
Resource
win10v200430
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mdist.us - Port:
587 - Username:
[email protected] - Password:
Receiving#4321
Targets
-
-
Target
overdue account letter.exe
-
Size
791KB
-
MD5
70c16d0855088ef43d81656b47332bba
-
SHA1
9d1a98abed89859a96fdfa0d1e40ad4fc63601a3
-
SHA256
f51d5ea747751e28a14ea5c32a59d2b2af33bb91c402408312c1baa85054acb3
-
SHA512
2c22c630c6b3bc8b63339b6e143f4c98921f8bbf6a31673bf7b85cd49789f2412dc067c2ec03a1c05a55b273468be354d2181353e151475b1c5e4388599e0596
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-