Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
SecuriteInfo.com.Win32.TrojanX-gen.4452.15781.exe
-
Size
627KB
-
Sample
230701-s1bvxaha44
-
MD5
442298f22003093233e6991f02745b2e
-
SHA1
b6d97547536d63dde15a5dd035335e4fe6773d63
-
SHA256
24857c1d542e4013445cb7a2c9f5c0c606c4a4361423f0b422ada5089cd92706
-
SHA512
b66817cb1c25e04cc2da7092b2d0c5644c09a2b5b5bc55b1c661b43302986769e00ee555576a4645a132538ee3f85eaec0e9bbda36f0310368d39c46ce7bff77
-
SSDEEP
12288:kRw4TDtT8LNz+Xnh2a1VyRgt4nKFUmJzppLNLveVlx7y:c98BywaqRgt80tJDNqVn
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.TrojanX-gen.4452.15781.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.TrojanX-gen.4452.15781.exe
Resource
win10v2004-20230621-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
webmail.exceltruea.com - Port:
587 - Username:
[email protected] - Password:
innocentchinedu - Email To:
[email protected]
Targets
-
-
Target
SecuriteInfo.com.Win32.TrojanX-gen.4452.15781.exe
-
Size
627KB
-
MD5
442298f22003093233e6991f02745b2e
-
SHA1
b6d97547536d63dde15a5dd035335e4fe6773d63
-
SHA256
24857c1d542e4013445cb7a2c9f5c0c606c4a4361423f0b422ada5089cd92706
-
SHA512
b66817cb1c25e04cc2da7092b2d0c5644c09a2b5b5bc55b1c661b43302986769e00ee555576a4645a132538ee3f85eaec0e9bbda36f0310368d39c46ce7bff77
-
SSDEEP
12288:kRw4TDtT8LNz+Xnh2a1VyRgt4nKFUmJzppLNLveVlx7y:c98BywaqRgt80tJDNqVn
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-