Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
INVOICE.exe
-
Size
924KB
-
Sample
221016-ng5xeshdcj
-
MD5
ef6a8631e2ef9254a647106872815787
-
SHA1
9149ed25102187a42bf8668a1b0426e1be63bc4a
-
SHA256
6f9a61bb7b17a4cb23733695d0c74ed1dff8d0645c2ee68f74b2cd6716baacd6
-
SHA512
90dad9ee231a1b6fb9d057677a76f2aebb36c5cb3224634eec88826524423cb9cc5c1bd2dc5e7792cd9de0458999306799e201166c076854a60de62fbb3fbef8
-
SSDEEP
12288:BiDg/A7YM21pisudT+i6Z0r7azvNvLBEet1imkRPuZb3TZj4ooHApUfrwY4p:Blppz67cvNFEU1imIq3ljfUfrwY4p
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
INVOICE.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
INVOICE.exe
-
Size
924KB
-
MD5
ef6a8631e2ef9254a647106872815787
-
SHA1
9149ed25102187a42bf8668a1b0426e1be63bc4a
-
SHA256
6f9a61bb7b17a4cb23733695d0c74ed1dff8d0645c2ee68f74b2cd6716baacd6
-
SHA512
90dad9ee231a1b6fb9d057677a76f2aebb36c5cb3224634eec88826524423cb9cc5c1bd2dc5e7792cd9de0458999306799e201166c076854a60de62fbb3fbef8
-
SSDEEP
12288:BiDg/A7YM21pisudT+i6Z0r7azvNvLBEet1imkRPuZb3TZj4ooHApUfrwY4p:Blppz67cvNFEU1imIq3ljfUfrwY4p
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-