Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
fiyat ve teslimat bilgisi_QS20202310109051__40GP.exe
-
Size
658KB
-
Sample
230511-za9sksae62
-
MD5
4677c29916237a928d40cce06e8733d9
-
SHA1
1c7974df3ae9d45b092475f940d5cf4956d5f288
-
SHA256
2492388a2635baa1438388add6c7c6c71d1793bb8b84757daf0b06f787543b39
-
SHA512
2a87da95dee41910ec5b77d82aae448b15d66f414160348d619598ede8489f00fc86cb455096a75007506c2cda8c7c8d52f8e017a922b7896b1910df71e40093
-
SSDEEP
12288:wqUNymU43Q7vYZNxrq+m4pwiCS/x50oAKuN2c2+qQH:CwmUhkxrqCX48Q2c2
Static task
static1
Behavioral task
behavioral1
Sample
fiyat ve teslimat bilgisi_QS20202310109051__40GP.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fiyat ve teslimat bilgisi_QS20202310109051__40GP.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1360033246:AAF6H8m6YrL09doyxtsvJzZ_cIl__BCF4aU/sendDocument
Targets
-
-
Target
fiyat ve teslimat bilgisi_QS20202310109051__40GP.exe
-
Size
658KB
-
MD5
4677c29916237a928d40cce06e8733d9
-
SHA1
1c7974df3ae9d45b092475f940d5cf4956d5f288
-
SHA256
2492388a2635baa1438388add6c7c6c71d1793bb8b84757daf0b06f787543b39
-
SHA512
2a87da95dee41910ec5b77d82aae448b15d66f414160348d619598ede8489f00fc86cb455096a75007506c2cda8c7c8d52f8e017a922b7896b1910df71e40093
-
SSDEEP
12288:wqUNymU43Q7vYZNxrq+m4pwiCS/x50oAKuN2c2+qQH:CwmUhkxrqCX48Q2c2
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-