Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
0082099375.doc__.rtf
-
Size
5KB
-
Sample
221028-gxmx8afagk
-
MD5
3352175ea33891c873d120f8eea80946
-
SHA1
150a4046aad42a29bc49991e3ba19e1177760896
-
SHA256
51bbdcd9da38798085d7fca64708ee95a44e3c3fc99a7cd69d112b68c89c1cbb
-
SHA512
427121edc98d77295cd6c34bdc42fa8d2ff9261fcf7eb9fc50f0d9a94cc4a8b8ababcb13a9299fa00826802a244d4921299e3731b2681cc0a5e6649179cf5e20
-
SSDEEP
96:DXuBRzlWMb2tCuoplmHiehHOigOccoz77BDmE24WzeEBWvHWbY:wplWMQAl8i+bUN7BCEdREaHWbY
Static task
static1
Behavioral task
behavioral1
Sample
0082099375.doc__.rtf
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
0082099375.doc__.rtf
Resource
win10v2004-20220812-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.godstar.com.br - Port:
587 - Username:
[email protected] - Password:
KINGqqqqqq@12
Targets
-
-
Target
0082099375.doc__.rtf
-
Size
5KB
-
MD5
3352175ea33891c873d120f8eea80946
-
SHA1
150a4046aad42a29bc49991e3ba19e1177760896
-
SHA256
51bbdcd9da38798085d7fca64708ee95a44e3c3fc99a7cd69d112b68c89c1cbb
-
SHA512
427121edc98d77295cd6c34bdc42fa8d2ff9261fcf7eb9fc50f0d9a94cc4a8b8ababcb13a9299fa00826802a244d4921299e3731b2681cc0a5e6649179cf5e20
-
SSDEEP
96:DXuBRzlWMb2tCuoplmHiehHOigOccoz77BDmE24WzeEBWvHWbY:wplWMQAl8i+bUN7BCEdREaHWbY
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-