Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
5e1fe72df804272ec2938d6a56a454ae5b6466a5c15131be5ded03b88563a7c9.zip
-
Size
225KB
-
Sample
230516-z12jwscf46
-
MD5
998f95e5a92fedba5dab0cc514504ba2
-
SHA1
b5180c96afc0654072c82feaf21d5fd88355cd9c
-
SHA256
bf3109a0922dcd5056882daef2280391c8d8f7a84bbc983e0eedde486c542906
-
SHA512
a332ca563529194644524ee31a2997b51f1145240b0cfda1edaca17128e6b4c09a5fdaea5d0ccd6d7d59b2f43ce897d98639fba83a3fcf05cafc0cd31e70eea7
-
SSDEEP
6144:XqCs0RXcX246AT5ItEoLOIIHml0TQw3kNb:XqWcBBuE8OfGmTQw3kNb
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Details_PDF.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Shipping Details_PDF.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot2062652208:AAEyc-7xEcUOQxNpdlexOidqQZT1Fi23E0A/sendDocument
Targets
-
-
Target
Shipping Details_PDF.exe
-
Size
258KB
-
MD5
0b1bdc6ed2e9c2b3087159e8bf06e159
-
SHA1
50c67efbb7fb0248ac34e9970ed60faa4a147440
-
SHA256
1f422e4f9b170b5a7bc282522ef446326d523b7b99b291c98957e74dcb4affcb
-
SHA512
ea340cd0921c71714c36899a3ebcaeb4cd6a8552fdec93db6b50762bc7edb61b63e5545de0550cb68e15ce99674c924b1fb384cbdd323df7f68151f3e9d242e2
-
SSDEEP
6144:QelDePKKBOgB5lvI0gbiM/BkCV3xVN/qPJt9Bo15qtwNn4:/APTOgAuMpV3dg04w
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-