Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04
-
Size
978KB
-
Sample
221010-nsjtbsbfd6
-
MD5
3095ea704287de6610fd95d0f0f2e926
-
SHA1
0a8ebbe160a334f8014d6a27111f35f18019d85e
-
SHA256
6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04
-
SHA512
319e6c5f6ffdf3436ca0b2d23371c8c40ca6435e30fe2f708746a4b048538df2052a803fb4b41d7728df55e2a75a0dc9ed37c6698dc05ead35fb55166fb8bbd7
-
SSDEEP
12288:/sX5y5GLGQsGvxEWet20qWJOSHG0bvZvgfkQnMpomnORJ3xkZ9/9iL4KRaQ8OOSu:/fvGvgt20qWUx0bhTpoOOzxkZ9/H
Static task
static1
Behavioral task
behavioral1
Sample
6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.jubana.cam - Port:
587 - Username:
[email protected] - Password:
3_sdYb:Q@pq5 - Email To:
[email protected]
Targets
-
-
Target
6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04
-
Size
978KB
-
MD5
3095ea704287de6610fd95d0f0f2e926
-
SHA1
0a8ebbe160a334f8014d6a27111f35f18019d85e
-
SHA256
6f0f753471141fc3b2946e7a56a35b74accf24d74382cac8027ddd835bd1ba04
-
SHA512
319e6c5f6ffdf3436ca0b2d23371c8c40ca6435e30fe2f708746a4b048538df2052a803fb4b41d7728df55e2a75a0dc9ed37c6698dc05ead35fb55166fb8bbd7
-
SSDEEP
12288:/sX5y5GLGQsGvxEWet20qWJOSHG0bvZvgfkQnMpomnORJ3xkZ9/9iL4KRaQ8OOSu:/fvGvgt20qWUx0bhTpoOOzxkZ9/H
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-