Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
3.doc
-
Size
3KB
-
Sample
230608-maqngsea89
-
MD5
b2376b5b15d1bd53f1f0dce3caf508a6
-
SHA1
b27cbaddcf2a69e193da0d3e80b938685b44d549
-
SHA256
a4f5010c998cf8fc3dd81dff7296ed17f975483d0a1bb3a73d89d4bd6c403ce4
-
SHA512
7ea40778d385af3feb0ada0b5c594bb436308e0c3571b964af6fb6dce3ff618b80b637ece54c8c049a5fedfc0eed7d49076c8b7924ada298cb720bf227073b2e
Static task
static1
Behavioral task
behavioral1
Sample
3.rtf
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3.rtf
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6116242756:AAGrnsiVT7lFhtm28Kz-vfXMED52iPxAFgc/
Targets
-
-
Target
3.doc
-
Size
3KB
-
MD5
b2376b5b15d1bd53f1f0dce3caf508a6
-
SHA1
b27cbaddcf2a69e193da0d3e80b938685b44d549
-
SHA256
a4f5010c998cf8fc3dd81dff7296ed17f975483d0a1bb3a73d89d4bd6c403ce4
-
SHA512
7ea40778d385af3feb0ada0b5c594bb436308e0c3571b964af6fb6dce3ff618b80b637ece54c8c049a5fedfc0eed7d49076c8b7924ada298cb720bf227073b2e
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-