Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
PURCHASE ORDER.exe
-
Size
699KB
-
Sample
230530-ssftwsad23
-
MD5
c3577d14cda7504d8ceaa9ae26fbb70d
-
SHA1
0c79db2c4ca4f153d231a6378159675f9a111e0f
-
SHA256
1b3662e68c3970c3ad2c9cff4b034a88823e67c7da54842519ac8dfefd87a883
-
SHA512
7d0a253a8676dd04202c9e643e0c4debf48c68f6b26163b38bb6726e1855bb41af93b1dbb139eddda689413ff56bb2c4218238492a954fc03cf5e0fef071f868
-
SSDEEP
12288:shqGsDJiANmZk7wqHbjuEIxhF/vM16DXY9soO:s4N1imP/ahvQi
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
PURCHASE ORDER.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
sarahfoils.com - Port:
587 - Username:
[email protected] - Password:
Scalatica01 - Email To:
[email protected]
Targets
-
-
Target
PURCHASE ORDER.exe
-
Size
699KB
-
MD5
c3577d14cda7504d8ceaa9ae26fbb70d
-
SHA1
0c79db2c4ca4f153d231a6378159675f9a111e0f
-
SHA256
1b3662e68c3970c3ad2c9cff4b034a88823e67c7da54842519ac8dfefd87a883
-
SHA512
7d0a253a8676dd04202c9e643e0c4debf48c68f6b26163b38bb6726e1855bb41af93b1dbb139eddda689413ff56bb2c4218238492a954fc03cf5e0fef071f868
-
SSDEEP
12288:shqGsDJiANmZk7wqHbjuEIxhF/vM16DXY9soO:s4N1imP/ahvQi
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-