Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    soa usd 88,362.rar

  • Size

    811KB

  • Sample

    221216-rvqlfahf7v

  • MD5

    dace6db3fe0da103b36f0d29015560aa

  • SHA1

    92b73dfb956985601c604e7cc2ed9b5f7fa775e3

  • SHA256

    f18369d534405f858d2c9027fc2d1255a092a45aa421eeae3445bc1f8aabc7e8

  • SHA512

    d3d884de28bec6909d4b2b7ddd63a1336acb4563c1330ad0705bc71bdc056a96330f6696e3571a5b2cc8845e42cd19be3560040218b7d07562bf9b085201da4c

  • SSDEEP

    12288:jJMjVVTC7bL9CYC+MCT+ejHK/KK3WAmG2H0x/eDyZAk523DhCXNDxV5yp6zbYU:OhCzRROrff2UcyZFkDhCVxjypysU

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      soa usd 88,362.exe

    • Size

      960KB

    • MD5

      0e4b935de0d3a5f7f55dcc7e2895e8fa

    • SHA1

      1232483ee0d3d6a4ece0237247d9cd5b9c36dcaa

    • SHA256

      31e49f1d5620418ef41da80331c1f3bfb578566ab0fdf53fc9890919a9896af5

    • SHA512

      bf6a34a956182b69aeb3b2113d01a250f5b81e7534386cab02fbf49fce8dc99f412883c59f460c1150e8c9f5f793b0277e36418076c5770b48b57efb1ed8da96

    • SSDEEP

      24576:1GYAKI2iimCOvCF6oiFKjqcqJDxwg5+Rka:1GYpX9mk6oNjwJ7eB

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks