Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Emergency Situation Surcharge Update.exe
-
Size
451KB
-
Sample
200710-vem1qs5jh2
-
MD5
4d7528ff3e3e634db83bdc55c56ac62a
-
SHA1
b63bd466732bdf5b9e43a20a7442b7547a4444bf
-
SHA256
3f258d6b65fd6594bc19ac4f3825112f78043a3c112f7bf56dd40bec84750a1e
-
SHA512
2297087cb141f830f7f45d5e8f0d6f363396096d655d12984a93d5b1068622e326bc9379b4e6c40f589e39a8b46a2b082ffc3126e8806edc406708d6c7d41ad4
Static task
static1
Behavioral task
behavioral1
Sample
Emergency Situation Surcharge Update.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
Emergency Situation Surcharge Update.exe
Resource
win10
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
General101
Targets
-
-
Target
Emergency Situation Surcharge Update.exe
-
Size
451KB
-
MD5
4d7528ff3e3e634db83bdc55c56ac62a
-
SHA1
b63bd466732bdf5b9e43a20a7442b7547a4444bf
-
SHA256
3f258d6b65fd6594bc19ac4f3825112f78043a3c112f7bf56dd40bec84750a1e
-
SHA512
2297087cb141f830f7f45d5e8f0d6f363396096d655d12984a93d5b1068622e326bc9379b4e6c40f589e39a8b46a2b082ffc3126e8806edc406708d6c7d41ad4
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Suspicious use of SetThreadContext
-