Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
sept_orderlist.doc
-
Size
12KB
-
Sample
220909-qdpgdacadr
-
MD5
c57544bbe3a0de2e2ee7aaa6052c6b70
-
SHA1
aa10cf5ef9aa7fad16765af1b20413f38dae6a7a
-
SHA256
1eac4b6a8d54ad0b0deb85eab520d4893e2c0a36879a04334b718299774eb5e2
-
SHA512
0dcd0e37a7a92310f9ec33de5931d1843b95c373f729accace9b75792d350235628abbd67f022e52d0248451eea709c223f7b2094a99bfcc1a440ff5b6b6086f
-
SSDEEP
192:XTppDiy6rYypivuzznBWVEsEH+b15Ry7x/X62pbv0ry:XTWyqYykvuBqvs+TsF/Dtv0m
Static task
static1
Behavioral task
behavioral1
Sample
sept_orderlist.rtf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
sept_orderlist.rtf
Resource
win10v2004-20220901-en
Malware Config
Extracted
Protocol: smtp- Host:
cp5ua.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$
Extracted
agenttesla
Protocol: smtp- Host:
cp5ua.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$ - Email To:
[email protected]
Targets
-
-
Target
sept_orderlist.doc
-
Size
12KB
-
MD5
c57544bbe3a0de2e2ee7aaa6052c6b70
-
SHA1
aa10cf5ef9aa7fad16765af1b20413f38dae6a7a
-
SHA256
1eac4b6a8d54ad0b0deb85eab520d4893e2c0a36879a04334b718299774eb5e2
-
SHA512
0dcd0e37a7a92310f9ec33de5931d1843b95c373f729accace9b75792d350235628abbd67f022e52d0248451eea709c223f7b2094a99bfcc1a440ff5b6b6086f
-
SSDEEP
192:XTppDiy6rYypivuzznBWVEsEH+b15Ry7x/X62pbv0ry:XTWyqYykvuBqvs+TsF/Dtv0m
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-