Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    freight invoices no 5634521.exe

  • Size

    6KB

  • Sample

    221102-ga6f2shfd8

  • MD5

    78e6732cbb52224998c71e85f84aa0aa

  • SHA1

    e2104d3f3b71ffb5f955f26dc42ec750e942e5bb

  • SHA256

    d2e229f7b947a970e3e102a72c3029ae532306c846186696bf275abf9a182a97

  • SHA512

    2b3174b3bb8d55a0af5a43ee9704d140ae465869ab127d093da512ef9bebc75f7900c88a70e93318ac86f1899bbc0829bb02d32d1ac5ad25b73c79b708b3ad0e

  • SSDEEP

    96:PbGgkLgKQBpTZ1rq+khl7kXyHhnl674F3GnUODL:PbGgkMF9Y+kP7kX61ZFv0

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5544798312:AAFCE9wlKN3YHM9MGYnKgWUb8D_lz2PBmQ8/

Targets

    • Target

      freight invoices no 5634521.exe

    • Size

      6KB

    • MD5

      78e6732cbb52224998c71e85f84aa0aa

    • SHA1

      e2104d3f3b71ffb5f955f26dc42ec750e942e5bb

    • SHA256

      d2e229f7b947a970e3e102a72c3029ae532306c846186696bf275abf9a182a97

    • SHA512

      2b3174b3bb8d55a0af5a43ee9704d140ae465869ab127d093da512ef9bebc75f7900c88a70e93318ac86f1899bbc0829bb02d32d1ac5ad25b73c79b708b3ad0e

    • SSDEEP

      96:PbGgkLgKQBpTZ1rq+khl7kXyHhnl674F3GnUODL:PbGgkMF9Y+kP7kX61ZFv0

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.