Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
soa usd 88,362.rar
-
Size
811KB
-
Sample
221216-rvqlfahf7v
-
MD5
dace6db3fe0da103b36f0d29015560aa
-
SHA1
92b73dfb956985601c604e7cc2ed9b5f7fa775e3
-
SHA256
f18369d534405f858d2c9027fc2d1255a092a45aa421eeae3445bc1f8aabc7e8
-
SHA512
d3d884de28bec6909d4b2b7ddd63a1336acb4563c1330ad0705bc71bdc056a96330f6696e3571a5b2cc8845e42cd19be3560040218b7d07562bf9b085201da4c
-
SSDEEP
12288:jJMjVVTC7bL9CYC+MCT+ejHK/KK3WAmG2H0x/eDyZAk523DhCXNDxV5yp6zbYU:OhCzRROrff2UcyZFkDhCVxjypysU
Static task
static1
Behavioral task
behavioral1
Sample
soa usd 88,362.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
soa usd 88,362.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.orogenicgroup-bd.com - Port:
587 - Username:
[email protected] - Password:
Hossain$3400 - Email To:
[email protected]
Targets
-
-
Target
soa usd 88,362.exe
-
Size
960KB
-
MD5
0e4b935de0d3a5f7f55dcc7e2895e8fa
-
SHA1
1232483ee0d3d6a4ece0237247d9cd5b9c36dcaa
-
SHA256
31e49f1d5620418ef41da80331c1f3bfb578566ab0fdf53fc9890919a9896af5
-
SHA512
bf6a34a956182b69aeb3b2113d01a250f5b81e7534386cab02fbf49fce8dc99f412883c59f460c1150e8c9f5f793b0277e36418076c5770b48b57efb1ed8da96
-
SSDEEP
24576:1GYAKI2iimCOvCF6oiFKjqcqJDxwg5+Rka:1GYpX9mk6oNjwJ7eB
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-