Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
175.xls
-
Size
1.1MB
-
Sample
230420-l8ehfahb35
-
MD5
4985d88abcec551ec55f1cbd62fee464
-
SHA1
59ca04cbc3ba18bea8aa9f5bf42f77650076063d
-
SHA256
854a52693609fa9e77cc388d175429f1d4dff68fdcd69ca17a754d7583cf962d
-
SHA512
b105f9666470effeebb3ccc3ab043953aaa0c7c6dba6804586b93c74dcd64ff4b82e685b5532dcbcd0a1e94ed702f9338220d73b241321d0e36d9ff983a28532
-
SSDEEP
24576:Zu9V+muDLwBk0ZDLwBk5iCtsIc2y7czeftNA3v1J:ZuN+4htvfLANA/1
Static task
static1
Behavioral task
behavioral1
Sample
175.xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
175.xls
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
azmlogistics.com - Port:
587 - Username:
[email protected] - Password:
Darvey365 - Email To:
[email protected]
Targets
-
-
Target
175.xls
-
Size
1.1MB
-
MD5
4985d88abcec551ec55f1cbd62fee464
-
SHA1
59ca04cbc3ba18bea8aa9f5bf42f77650076063d
-
SHA256
854a52693609fa9e77cc388d175429f1d4dff68fdcd69ca17a754d7583cf962d
-
SHA512
b105f9666470effeebb3ccc3ab043953aaa0c7c6dba6804586b93c74dcd64ff4b82e685b5532dcbcd0a1e94ed702f9338220d73b241321d0e36d9ff983a28532
-
SSDEEP
24576:Zu9V+muDLwBk0ZDLwBk5iCtsIc2y7czeftNA3v1J:ZuN+4htvfLANA/1
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-