Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Fwd bank details.exe
-
Size
701KB
-
Sample
230216-t3wtjaac31
-
MD5
84784fdb92f56f871978fc2138334abb
-
SHA1
9931a21ab800c6ea1482a7960398d84370a68d1a
-
SHA256
ee08bb40195e3f68a10bae8a2ba56faa85e9ba185a6155698bf2753e23f09c62
-
SHA512
39e67df24f949c2124f022dfee1da2f8bd0f947e40c4211940a7511b4410b9bb87a706e2db6619aa7e5927dbeb9ac5bb28c902f43ebe19c2def8fd4b9131445e
-
SSDEEP
12288:GqzGP7CRxd/Q3UablBz3sKFLftBsmGIj37kEFQhwVtqDSugDs+9t:bxSvxjG84EJtqDSu
Static task
static1
Behavioral task
behavioral1
Sample
Fwd bank details.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Fwd bank details.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bosphoreqroup.com - Port:
587 - Username:
[email protected] - Password:
password2022@ - Email To:
[email protected]
Targets
-
-
Target
Fwd bank details.exe
-
Size
701KB
-
MD5
84784fdb92f56f871978fc2138334abb
-
SHA1
9931a21ab800c6ea1482a7960398d84370a68d1a
-
SHA256
ee08bb40195e3f68a10bae8a2ba56faa85e9ba185a6155698bf2753e23f09c62
-
SHA512
39e67df24f949c2124f022dfee1da2f8bd0f947e40c4211940a7511b4410b9bb87a706e2db6619aa7e5927dbeb9ac5bb28c902f43ebe19c2def8fd4b9131445e
-
SSDEEP
12288:GqzGP7CRxd/Q3UablBz3sKFLftBsmGIj37kEFQhwVtqDSugDs+9t:bxSvxjG84EJtqDSu
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-