Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
MT 103SWIFT 16052.exe
-
Size
720KB
-
Sample
230601-qmdq8sed68
-
MD5
d7970ac9cf0f446fae583e16827b603f
-
SHA1
6487e16370c39236d66e5acfc4fe3e39f57acb30
-
SHA256
d4ffd9c9e99e01d4c4a60289035b3191b70b02f5bc6a8c7bac722ff124dd1cd8
-
SHA512
b2fdfeb1c8ab53279551939e775d576b2706c7eadb60193622dc3bf4c6acb8cf63789a8ce92ead39bb058d1a80c7afe118b3bb619c04ae2a8490804a344527d3
-
SSDEEP
12288:I8axsEP/SJabc1OyUC8sYLLxADFjWQbfnlmMDNEiETohzFQlgkMXzVBH6e:I3/4kyt8sImZJddZEZohzGmxBa
Static task
static1
Behavioral task
behavioral1
Sample
MT 103SWIFT 16052.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
MT 103SWIFT 16052.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.garagerobert.be - Port:
587 - Username:
[email protected] - Password:
dibi7779 - Email To:
[email protected]
Targets
-
-
Target
MT 103SWIFT 16052.exe
-
Size
720KB
-
MD5
d7970ac9cf0f446fae583e16827b603f
-
SHA1
6487e16370c39236d66e5acfc4fe3e39f57acb30
-
SHA256
d4ffd9c9e99e01d4c4a60289035b3191b70b02f5bc6a8c7bac722ff124dd1cd8
-
SHA512
b2fdfeb1c8ab53279551939e775d576b2706c7eadb60193622dc3bf4c6acb8cf63789a8ce92ead39bb058d1a80c7afe118b3bb619c04ae2a8490804a344527d3
-
SSDEEP
12288:I8axsEP/SJabc1OyUC8sYLLxADFjWQbfnlmMDNEiETohzFQlgkMXzVBH6e:I3/4kyt8sImZJddZEZohzGmxBa
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-