Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68.exe
-
Size
828KB
-
Sample
220907-mkdfxahacq
-
MD5
f959caab239f677486946f7f09184c85
-
SHA1
ea80e8a5e9ffd652cfcc89fae7a4c758220769a7
-
SHA256
f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68
-
SHA512
dd26c9e47c2906f69fbb2784f7e284457212b1eb7a591f23f01abfd06cd9ff897c47477c98ec220c05e3e81c1ca082be4f64d1eab6866d97da99372ed194de76
-
SSDEEP
12288:a6HNnpNtD5T39IOCFWXr3f9RXrn2Ve0ikyW5a5VLW4ZNX/LJCl5RXPi2VDRq5u8S:9NVDJ93CFWXrP9REedRWc9vLs
Static task
static1
Behavioral task
behavioral1
Sample
f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.mhecoinc.com.ph - Port:
587 - Username:
[email protected] - Password:
Cbe959697
Extracted
agenttesla
Protocol: smtp- Host:
mail.mhecoinc.com.ph - Port:
587 - Username:
[email protected] - Password:
Cbe959697 - Email To:
[email protected]
Targets
-
-
Target
f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68.exe
-
Size
828KB
-
MD5
f959caab239f677486946f7f09184c85
-
SHA1
ea80e8a5e9ffd652cfcc89fae7a4c758220769a7
-
SHA256
f1cf24785edc789cb82b44715a3a4f97063206fb599a61a6201da7b80d6cfb68
-
SHA512
dd26c9e47c2906f69fbb2784f7e284457212b1eb7a591f23f01abfd06cd9ff897c47477c98ec220c05e3e81c1ca082be4f64d1eab6866d97da99372ed194de76
-
SSDEEP
12288:a6HNnpNtD5T39IOCFWXr3f9RXrn2Ve0ikyW5a5VLW4ZNX/LJCl5RXPi2VDRq5u8S:9NVDJ93CFWXrP9REedRWc9vLs
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-