Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Proof of Payment_Presentation of needed production materials with technical drawings componenet.exe
-
Size
1.0MB
-
Sample
221220-yvyelsah76
-
MD5
412dc04cd285536555dd04346b3eafdd
-
SHA1
59e5a35ee4fc632044b418cac26778702b1ccd27
-
SHA256
0d645b8f0f44784c4f9a2d883a1a1efd6432127988ed94b3881c794c868dcddd
-
SHA512
afd2348032df1f0c68631aa1f3bb8c1013245508256c7fc94275c48d721fa43f6308544aaf749d5ab718f35f179cd94ea18a3a517cfd25749b3e8838ab166334
-
SSDEEP
24576:kYWPB86eyZ6qTh5o6m9nffXgHEiTznmb1g3R3XR86:k326J6WLmoEiTz8
Static task
static1
Behavioral task
behavioral1
Sample
Proof of Payment_Presentation of needed production materials with technical drawings componenet.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Proof of Payment_Presentation of needed production materials with technical drawings componenet.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5590596148:AAFELAezvK26mOp3KWIpAgxEVzQMQ56n6zg/
Targets
-
-
Target
Proof of Payment_Presentation of needed production materials with technical drawings componenet.exe
-
Size
1.0MB
-
MD5
412dc04cd285536555dd04346b3eafdd
-
SHA1
59e5a35ee4fc632044b418cac26778702b1ccd27
-
SHA256
0d645b8f0f44784c4f9a2d883a1a1efd6432127988ed94b3881c794c868dcddd
-
SHA512
afd2348032df1f0c68631aa1f3bb8c1013245508256c7fc94275c48d721fa43f6308544aaf749d5ab718f35f179cd94ea18a3a517cfd25749b3e8838ab166334
-
SSDEEP
24576:kYWPB86eyZ6qTh5o6m9nffXgHEiTznmb1g3R3XR86:k326J6WLmoEiTz8
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-