Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
March-April Outstanding Invoices.pdf.exe
-
Size
235KB
-
Sample
230504-htsjzacd6z
-
MD5
6a401c99a6197e09374e3c902c45624c
-
SHA1
bb3cfc935c1b006060c3e395db7d12461c8fe040
-
SHA256
b0d0cece64fdca1ef7ea77f3ada5bb2bc9c3e20a3e171cd824e1a35eb8a5b02e
-
SHA512
4cd3439f8cfbc09d4af7e0cc4576234cb94a4481266d9431279e834c4783e0a41bff7a9b4b16daf59c61e3597ae3e06c86e210078aba160a4f10f59f146e0641
-
SSDEEP
6144:nYv3OM2fecdgq+H5s/rM+jF3UbnxMfj0lsCPGF6n4:nY/Ud9K5wrM+jF3UbxqXCP
Static task
static1
Behavioral task
behavioral1
Sample
March-April Outstanding Invoices.pdf.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
March-April Outstanding Invoices.pdf.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.biovision.ae - Port:
587 - Username:
[email protected] - Password:
Biovision2022** - Email To:
[email protected]
Targets
-
-
Target
March-April Outstanding Invoices.pdf.exe
-
Size
235KB
-
MD5
6a401c99a6197e09374e3c902c45624c
-
SHA1
bb3cfc935c1b006060c3e395db7d12461c8fe040
-
SHA256
b0d0cece64fdca1ef7ea77f3ada5bb2bc9c3e20a3e171cd824e1a35eb8a5b02e
-
SHA512
4cd3439f8cfbc09d4af7e0cc4576234cb94a4481266d9431279e834c4783e0a41bff7a9b4b16daf59c61e3597ae3e06c86e210078aba160a4f10f59f146e0641
-
SSDEEP
6144:nYv3OM2fecdgq+H5s/rM+jF3UbnxMfj0lsCPGF6n4:nY/Ud9K5wrM+jF3UbxqXCP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-