Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    98099e5b5bfdbc94f477af2aa269f21d1eac4fafeae9be6421fcfa58e5d0397a

  • Size

    167KB

  • Sample

    230308-ngrd2afd7v

  • MD5

    8292cbeee2dbce7c7c2d27dbfe7f171c

  • SHA1

    ff606b2b53ab35edcbc11aaea8bfc33d033bfff2

  • SHA256

    98099e5b5bfdbc94f477af2aa269f21d1eac4fafeae9be6421fcfa58e5d0397a

  • SHA512

    c0e5b242d7d195edc97fa0354d5e8ff03bc8834ccc2d1b7edd25efae6fa82b340fcd1d1545ca2055333214844d633be4038aa63bdd8f8cae5a19f80c243e4ecb

  • SSDEEP

    3072:sFEDBdPxMBr3M4t4g7PVEmrz7iz5ZD3GkAgyjOXdd1JP3il:GEDTgrLNEO7qZD2kbCcJvi

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.goaelectronics.co.in
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Tourism@2021

Targets

    • Target

      98099e5b5bfdbc94f477af2aa269f21d1eac4fafeae9be6421fcfa58e5d0397a

    • Size

      167KB

    • MD5

      8292cbeee2dbce7c7c2d27dbfe7f171c

    • SHA1

      ff606b2b53ab35edcbc11aaea8bfc33d033bfff2

    • SHA256

      98099e5b5bfdbc94f477af2aa269f21d1eac4fafeae9be6421fcfa58e5d0397a

    • SHA512

      c0e5b242d7d195edc97fa0354d5e8ff03bc8834ccc2d1b7edd25efae6fa82b340fcd1d1545ca2055333214844d633be4038aa63bdd8f8cae5a19f80c243e4ecb

    • SSDEEP

      3072:sFEDBdPxMBr3M4t4g7PVEmrz7iz5ZD3GkAgyjOXdd1JP3il:GEDTgrLNEO7qZD2kbCcJvi

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks