Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Conferma di pagamento 11042022 0039995866 567785687979.gz
-
Size
763KB
-
Sample
221104-w8b3eshgf9
-
MD5
a66b9092097d9335e9be7ecb6e2255d7
-
SHA1
c4865a51f0b1a8bbeedeb16094d83a59476fa03e
-
SHA256
e026c3500e5f119b24365a155badf2f3ee1fafb9664db2729ab04733b9110599
-
SHA512
238a828986a8c000e3c2fb09cc04a30b580279b5d5545aab976560c4128b46848276d669d4f303ba8fc02ee92d399c0a6c3797deaab0c168ae8fa37bb85bbdad
-
SSDEEP
12288:yOucvR2B/0ghq6m2oTXzIT8R5OiZB4ZHHziKZptHug8uV/vTuhbqujA0EsG4kQ3r:VucvR2bhqJHET8R5Oi8ZHH2K58uqFquf
Static task
static1
Behavioral task
behavioral1
Sample
Conferma di pagamento 11042022 0039995866 567785687979.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Conferma di pagamento 11042022 0039995866 567785687979.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.mgcpakistan.com - Port:
21 - Username:
[email protected] - Password:
boygirl123456
Targets
-
-
Target
Conferma di pagamento 11042022 0039995866 567785687979.exe
-
Size
1022KB
-
MD5
936a3a2a3a3b00b10c23ced7360ed9d7
-
SHA1
4314a75a88df33e5d25663acbbeedb66bbcfe808
-
SHA256
b2d2e3a6a8a80da11ebbab727216140a5f68243136c8da4c31cefdfdc4669253
-
SHA512
593d12e971320360ec07451d1e11547e615f5ea31e885758954255890f7dcc0ceee19808b099347e2c6a2cec8feadd31c424520cb51f2179b20bb7d941be78ed
-
SSDEEP
24576:svt27hqJx8T6RLOKQZHJQiV8KcFK0DKDsGYy8TAqbD:sYNqcTeOKQZpzGDfTD
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-