Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
98099e5b5bfdbc94f477af2aa269f21d1eac4fafeae9be6421fcfa58e5d0397a
-
Size
167KB
-
Sample
230308-ngrd2afd7v
-
MD5
8292cbeee2dbce7c7c2d27dbfe7f171c
-
SHA1
ff606b2b53ab35edcbc11aaea8bfc33d033bfff2
-
SHA256
98099e5b5bfdbc94f477af2aa269f21d1eac4fafeae9be6421fcfa58e5d0397a
-
SHA512
c0e5b242d7d195edc97fa0354d5e8ff03bc8834ccc2d1b7edd25efae6fa82b340fcd1d1545ca2055333214844d633be4038aa63bdd8f8cae5a19f80c243e4ecb
-
SSDEEP
3072:sFEDBdPxMBr3M4t4g7PVEmrz7iz5ZD3GkAgyjOXdd1JP3il:GEDTgrLNEO7qZD2kbCcJvi
Behavioral task
behavioral1
Sample
98099e5b5bfdbc94f477af2aa269f21d1eac4fafeae9be6421fcfa58e5d0397a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
98099e5b5bfdbc94f477af2aa269f21d1eac4fafeae9be6421fcfa58e5d0397a.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.goaelectronics.co.in - Port:
587 - Username:
[email protected] - Password:
Tourism@2021 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.goaelectronics.co.in - Port:
587 - Username:
[email protected] - Password:
Tourism@2021
Targets
-
-
Target
98099e5b5bfdbc94f477af2aa269f21d1eac4fafeae9be6421fcfa58e5d0397a
-
Size
167KB
-
MD5
8292cbeee2dbce7c7c2d27dbfe7f171c
-
SHA1
ff606b2b53ab35edcbc11aaea8bfc33d033bfff2
-
SHA256
98099e5b5bfdbc94f477af2aa269f21d1eac4fafeae9be6421fcfa58e5d0397a
-
SHA512
c0e5b242d7d195edc97fa0354d5e8ff03bc8834ccc2d1b7edd25efae6fa82b340fcd1d1545ca2055333214844d633be4038aa63bdd8f8cae5a19f80c243e4ecb
-
SSDEEP
3072:sFEDBdPxMBr3M4t4g7PVEmrz7iz5ZD3GkAgyjOXdd1JP3il:GEDTgrLNEO7qZD2kbCcJvi
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-