Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
FedEx Receipt_2314174712.exe
-
Size
821KB
-
Sample
230203-x6nh4sdh7w
-
MD5
8d0a2a254b9cb085a733265d00950789
-
SHA1
e0ad9b267f52bc134ce9f72e77e507fc9e4f01c4
-
SHA256
02efa36dd4234ec4d70a085ef835696433943672021e90a20bb1d61bf0871ed8
-
SHA512
041597c350b2a3f46cc7fde65f12e3c0ab7848bf9b9fca23a512a89f63b5c77d0675a3d8ac96e9b6247dcd21c8e32a9adaa7901d97ddb42a11d7864c12f78c5f
-
SSDEEP
24576:HeSqG4yPaw6F0s14r5K7R6Zp79Y9OtgOSBVaogRM:IlWs14r5K7y9YwtgOS+ogC
Static task
static1
Behavioral task
behavioral1
Sample
FedEx Receipt_2314174712.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
FedEx Receipt_2314174712.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5826219676:AAHzaO_KidyTjZ5PTwFErYpZivpT8wfDUno/
Targets
-
-
Target
FedEx Receipt_2314174712.exe
-
Size
821KB
-
MD5
8d0a2a254b9cb085a733265d00950789
-
SHA1
e0ad9b267f52bc134ce9f72e77e507fc9e4f01c4
-
SHA256
02efa36dd4234ec4d70a085ef835696433943672021e90a20bb1d61bf0871ed8
-
SHA512
041597c350b2a3f46cc7fde65f12e3c0ab7848bf9b9fca23a512a89f63b5c77d0675a3d8ac96e9b6247dcd21c8e32a9adaa7901d97ddb42a11d7864c12f78c5f
-
SSDEEP
24576:HeSqG4yPaw6F0s14r5K7R6Zp79Y9OtgOSBVaogRM:IlWs14r5K7y9YwtgOS+ogC
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-