Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    27caf0391db69d2b2543a0172747e62a9a6e208c

  • Size

    556KB

  • Sample

    230203-x9vrlaag59

  • MD5

    b757c4ac5a46c4e9fc2cf9e924702804

  • SHA1

    27caf0391db69d2b2543a0172747e62a9a6e208c

  • SHA256

    6941a5420e23e7309cc09e6ffebf847a7c781dbbb726996a2b3d36340d347819

  • SHA512

    79cb0c6d3e2ec59f230fb221937104bd9a6890276eb1c0a8283340359380610cc8f8b3c0875b1b0e360967d50f924a9a8b4be7a2f70165927d3278f660198b36

  • SSDEEP

    12288:CYZ/txeoKFg+15c6qRUbTAg9sSBa04UtUFeJ9/TG+R:CYZ/HeoKC+1KnG9sSp4UtUcn/R

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6189375980:AAEQgcKnWY3deSQI5AAcHwLSEAvydZ5KNIs/

Targets

    • Target

      27caf0391db69d2b2543a0172747e62a9a6e208c

    • Size

      556KB

    • MD5

      b757c4ac5a46c4e9fc2cf9e924702804

    • SHA1

      27caf0391db69d2b2543a0172747e62a9a6e208c

    • SHA256

      6941a5420e23e7309cc09e6ffebf847a7c781dbbb726996a2b3d36340d347819

    • SHA512

      79cb0c6d3e2ec59f230fb221937104bd9a6890276eb1c0a8283340359380610cc8f8b3c0875b1b0e360967d50f924a9a8b4be7a2f70165927d3278f660198b36

    • SSDEEP

      12288:CYZ/txeoKFg+15c6qRUbTAg9sSBa04UtUFeJ9/TG+R:CYZ/HeoKC+1KnG9sSp4UtUcn/R

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.