Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

REVISED INVOICE.xlsx

windows7-x64

10

REVISED INVOICE.xlsx

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    REVISED INVOICE.xlsx

  • Size

    180KB

  • Sample

    221003-h1hcksecdj

  • MD5

    4f12f3d51d9d16c64b0a4b826bbc5b11

  • SHA1

    f1e8d4ac587fc56e83fff309b7e4684298e3d8c0

  • SHA256

    29013957f0c83fb4e8b4c8e8461b17987fa66101fc438c07d0e89c42aa3db4e2

  • SHA512

    e1cbe000d390c3a276a7b067fabdb25814aea2b96c06375171a72d8c65992c46e12806a5fc77272034ec1be5ef0653c980f5d2e5546cea8d64895d128e58a0ee

  • SSDEEP

    3072:OuLGZNKq0qSv+tiKx9RT8FhaWAbVnXLxZryxVsE3h3SY2W8U+6oEgVPAsW+mS:4ZNwVv0GtA9XdxyYER3d2W8hFEgRAr+P

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/sendDocument

Targets

    • Target

      REVISED INVOICE.xlsx

    • Size

      180KB

    • MD5

      4f12f3d51d9d16c64b0a4b826bbc5b11

    • SHA1

      f1e8d4ac587fc56e83fff309b7e4684298e3d8c0

    • SHA256

      29013957f0c83fb4e8b4c8e8461b17987fa66101fc438c07d0e89c42aa3db4e2

    • SHA512

      e1cbe000d390c3a276a7b067fabdb25814aea2b96c06375171a72d8c65992c46e12806a5fc77272034ec1be5ef0653c980f5d2e5546cea8d64895d128e58a0ee

    • SSDEEP

      3072:OuLGZNKq0qSv+tiKx9RT8FhaWAbVnXLxZryxVsE3h3SY2W8U+6oEgVPAsW+mS:4ZNwVv0GtA9XdxyYER3d2W8hFEgRAr+P

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks