Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
open-order#456789.exe
-
Size
784KB
-
Sample
230614-mw82ysga92
-
MD5
d26a255fae6242428ca0af216a31aa89
-
SHA1
39a772187c8f21b64e04802fca9601c0750d40dd
-
SHA256
e0da04e7d3428e2add35de8c95b1fac697a1180d9f8b73c08f779dd20ae1ec78
-
SHA512
bc1687003646e2c44cd68f56f52a25c891d6de4caa2ebc014081aadd49d5e5ed625dea354e4c283a1cfff5c3d6abdbd1c38a0bd9d3ae0766ba4a3e075a7f5b2a
-
SSDEEP
12288:2lKnuWEXqXdVLVWhbUdMwq7cIQQ+jKHlnecK0fIiJLQfnIN:DT4qXdVBWhAdrqoHQQKHpPKyLQf
Static task
static1
Behavioral task
behavioral1
Sample
open-order#456789.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
open-order#456789.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.expertsconsultgh.co - Port:
587 - Username:
[email protected] - Password:
Oppong.2012 - Email To:
[email protected]
Targets
-
-
Target
open-order#456789.exe
-
Size
784KB
-
MD5
d26a255fae6242428ca0af216a31aa89
-
SHA1
39a772187c8f21b64e04802fca9601c0750d40dd
-
SHA256
e0da04e7d3428e2add35de8c95b1fac697a1180d9f8b73c08f779dd20ae1ec78
-
SHA512
bc1687003646e2c44cd68f56f52a25c891d6de4caa2ebc014081aadd49d5e5ed625dea354e4c283a1cfff5c3d6abdbd1c38a0bd9d3ae0766ba4a3e075a7f5b2a
-
SSDEEP
12288:2lKnuWEXqXdVLVWhbUdMwq7cIQQ+jKHlnecK0fIiJLQfnIN:DT4qXdVBWhAdrqoHQQKHpPKyLQf
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-