Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Quotation.exe
-
Size
431KB
-
Sample
200708-zzkc47mcr2
-
MD5
deceda9833ced5d4a565385fd60ce0aa
-
SHA1
29f9ae1c605d753e1ffcd156b17d4907849f8079
-
SHA256
4e4f9a06f2544bb63460caaf2aeb35875d71c2c644060a12b8bb28bbf878eb61
-
SHA512
411e9b584e9be4c8ad0a70c9cb613925ce3fb5ddc45ae31ea09adff919b983b1237b461fe12465081850eb83810d3539b98a6c3641c197787bf837807d9081f3
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v200430
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mexicanproduct.com.mx - Port:
587 - Username:
[email protected] - Password:
Produccion2020.
Targets
-
-
Target
Quotation.exe
-
Size
431KB
-
MD5
deceda9833ced5d4a565385fd60ce0aa
-
SHA1
29f9ae1c605d753e1ffcd156b17d4907849f8079
-
SHA256
4e4f9a06f2544bb63460caaf2aeb35875d71c2c644060a12b8bb28bbf878eb61
-
SHA512
411e9b584e9be4c8ad0a70c9cb613925ce3fb5ddc45ae31ea09adff919b983b1237b461fe12465081850eb83810d3539b98a6c3641c197787bf837807d9081f3
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-