Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
AWB # 1835257406.PDF.exe
-
Size
966KB
-
Sample
221217-mqjvwabd7w
-
MD5
1a490260d5a847f0f0f0d91d76cd3dba
-
SHA1
ba58db3865114caa06f58469ccc3d9052b9812b8
-
SHA256
e43659dac9e8276ec4f3948c5211c3c64b34b34307b1ad15681c81529c8b64ae
-
SHA512
240a7cc26d59f6f193ebd58420793593f107d582626c32313f2904a8b316b2e22f36c5df2061f0abcedc9f7753dd3d479c4a3c06cd5c8714eac9160c0c19e2f6
-
SSDEEP
12288:9PhNUJQSHlQhr12iNEpos0ckmPU9Lvnofxgvjrx17sPE3E:VrSHlQhr11E9V8Lvof2jrxqPE3
Static task
static1
Behavioral task
behavioral1
Sample
AWB # 1835257406.PDF.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
AWB # 1835257406.PDF.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5495243543:AAG3XPeGW7yqfXF6_EXjGSfO9SWHJTpqVsU/
Targets
-
-
Target
AWB # 1835257406.PDF.exe
-
Size
966KB
-
MD5
1a490260d5a847f0f0f0d91d76cd3dba
-
SHA1
ba58db3865114caa06f58469ccc3d9052b9812b8
-
SHA256
e43659dac9e8276ec4f3948c5211c3c64b34b34307b1ad15681c81529c8b64ae
-
SHA512
240a7cc26d59f6f193ebd58420793593f107d582626c32313f2904a8b316b2e22f36c5df2061f0abcedc9f7753dd3d479c4a3c06cd5c8714eac9160c0c19e2f6
-
SSDEEP
12288:9PhNUJQSHlQhr12iNEpos0ckmPU9Lvnofxgvjrx17sPE3E:VrSHlQhr11E9V8Lvof2jrxqPE3
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-