Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Euro Swift Copy·PDF.scr

  • Size

    1.3MB

  • Sample

    230511-xwn2wsab63

  • MD5

    b67a90c8381e471791cc4e5f7e43829f

  • SHA1

    7ecac5583356989ae599e6a1a096c791b350e7c7

  • SHA256

    6e19455a9618b20fae8404a9b3c9f4f37d2b2cf032faf61d3837b59bf9497666

  • SHA512

    04a8f5ca1793c2bc35451ab617416d2b93a8be3471bb73305d359c96b818b2265e702e37425ee2aafee5e3132cd1a01e235df1174bdee23e3a2b1e694be6d555

  • SSDEEP

    24576:zCdQy7r3oUV2nJEFQ/S26klFhX1Ar7QemnokIUSSm0U:eXgKF4S2z/XOed

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Euro Swift Copy·PDF.scr

    • Size

      1.3MB

    • MD5

      b67a90c8381e471791cc4e5f7e43829f

    • SHA1

      7ecac5583356989ae599e6a1a096c791b350e7c7

    • SHA256

      6e19455a9618b20fae8404a9b3c9f4f37d2b2cf032faf61d3837b59bf9497666

    • SHA512

      04a8f5ca1793c2bc35451ab617416d2b93a8be3471bb73305d359c96b818b2265e702e37425ee2aafee5e3132cd1a01e235df1174bdee23e3a2b1e694be6d555

    • SSDEEP

      24576:zCdQy7r3oUV2nJEFQ/S26klFhX1Ar7QemnokIUSSm0U:eXgKF4S2z/XOed

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks