Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

07387399.exe

windows7-x64

10

07387399.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07387399.exe

  • Size

    693KB

  • Sample

    230530-jrg6wsgc92

  • MD5

    d4e2fa45feaaaae4012c30b47c9eb9cd

  • SHA1

    d0ec277a2a16568e40794a401e04169e570aa656

  • SHA256

    da59dd1b2e20e25f770267c503b455d48c710a285721f78ab1a8070200d67261

  • SHA512

    722d37e693b891248d2007426e991b41acb3d52c388f9692aba121b3642d974584adf09f6ca5c76db97a959aed0698b1ff41ed3f651eab1682636d0968cef45a

  • SSDEEP

    12288:A3EqL+PFCyEJwF8hNLXcqkKpbNZ3vgr8:8JL+4yEJwu37Dp5dYw

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/

Targets

    • Target

      07387399.exe

    • Size

      693KB

    • MD5

      d4e2fa45feaaaae4012c30b47c9eb9cd

    • SHA1

      d0ec277a2a16568e40794a401e04169e570aa656

    • SHA256

      da59dd1b2e20e25f770267c503b455d48c710a285721f78ab1a8070200d67261

    • SHA512

      722d37e693b891248d2007426e991b41acb3d52c388f9692aba121b3642d974584adf09f6ca5c76db97a959aed0698b1ff41ed3f651eab1682636d0968cef45a

    • SSDEEP

      12288:A3EqL+PFCyEJwF8hNLXcqkKpbNZ3vgr8:8JL+4yEJwu37Dp5dYw

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks