Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

BH0ePQy3XJSkIWO.exe

windows7-x64

10

BH0ePQy3XJSkIWO.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BH0ePQy3XJSkIWO.exe

  • Size

    676KB

  • Sample

    230419-fnyspagd66

  • MD5

    7c1367abb438f60292f78519fa2b851b

  • SHA1

    75c47cb21be625391991f41d4e55341e68a69410

  • SHA256

    f46e300e4db069550efc75aa67fb2929de58b2c4b543a7f9341b78f951ab9bd8

  • SHA512

    e8e129160f5e97beef5bbfbaf0cdfc0048d4b9d27991989dbb5e633b3a290f18e26957e9ea7a30f1c1b86d2313d233d7586c0480494294a3aad5780ce8d8a12d

  • SSDEEP

    12288:nRBO5ZZC/W2n9xsMHyyE566gQJtJNCXD3jnrleiDs+zjBVs/0zG:nRqTC/fDtS1rJtTCTIig+zjz6

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      BH0ePQy3XJSkIWO.exe

    • Size

      676KB

    • MD5

      7c1367abb438f60292f78519fa2b851b

    • SHA1

      75c47cb21be625391991f41d4e55341e68a69410

    • SHA256

      f46e300e4db069550efc75aa67fb2929de58b2c4b543a7f9341b78f951ab9bd8

    • SHA512

      e8e129160f5e97beef5bbfbaf0cdfc0048d4b9d27991989dbb5e633b3a290f18e26957e9ea7a30f1c1b86d2313d233d7586c0480494294a3aad5780ce8d8a12d

    • SSDEEP

      12288:nRBO5ZZC/W2n9xsMHyyE566gQJtJNCXD3jnrleiDs+zjBVs/0zG:nRqTC/fDtS1rJtTCTIig+zjz6

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks