Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
07387399.exe
-
Size
693KB
-
Sample
230530-jrg6wsgc92
-
MD5
d4e2fa45feaaaae4012c30b47c9eb9cd
-
SHA1
d0ec277a2a16568e40794a401e04169e570aa656
-
SHA256
da59dd1b2e20e25f770267c503b455d48c710a285721f78ab1a8070200d67261
-
SHA512
722d37e693b891248d2007426e991b41acb3d52c388f9692aba121b3642d974584adf09f6ca5c76db97a959aed0698b1ff41ed3f651eab1682636d0968cef45a
-
SSDEEP
12288:A3EqL+PFCyEJwF8hNLXcqkKpbNZ3vgr8:8JL+4yEJwu37Dp5dYw
Static task
static1
Behavioral task
behavioral1
Sample
07387399.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
07387399.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/
Targets
-
-
Target
07387399.exe
-
Size
693KB
-
MD5
d4e2fa45feaaaae4012c30b47c9eb9cd
-
SHA1
d0ec277a2a16568e40794a401e04169e570aa656
-
SHA256
da59dd1b2e20e25f770267c503b455d48c710a285721f78ab1a8070200d67261
-
SHA512
722d37e693b891248d2007426e991b41acb3d52c388f9692aba121b3642d974584adf09f6ca5c76db97a959aed0698b1ff41ed3f651eab1682636d0968cef45a
-
SSDEEP
12288:A3EqL+PFCyEJwF8hNLXcqkKpbNZ3vgr8:8JL+4yEJwu37Dp5dYw
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-