Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

DOCUMENT.exe

windows7-x64

10

DOCUMENT.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DOCUMENTS.IMG

  • Size

    3.5MB

  • Sample

    230703-zaa91saa79

  • MD5

    5512b053e24cfed96ce273200fb6a00e

  • SHA1

    6dab2e5da6d5102f72f0a00b30f082f5dde2c312

  • SHA256

    8293841d6472599e38fed17d7fd84d1b73424f36edc6eb7cbfbf87130224810e

  • SHA512

    6fb20c5b9916e6c03db463facc5f0ae412f8e99e4c13e6707128958deb824a96c4f72a2ab69d5eb0b44b5fc3ab0bfb140c24189a0681350264ed76b01676cb65

  • SSDEEP

    24576:1rYyiPh6GlRD/FBAZgi04nHH5xGXDx8NFN4Td60tBuyGKq3zZHph/g6A9yROP+Sf:NbiPhYzZHpNOmSRp

Score
10/10
agentteslacollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://files.000webhost.com
  • Port:
    21
  • Username:
    tain00
  • Password:
    computer@2020

Targets

    • Target

      DOCUMENT.EXE

    • Size

      3.0MB

    • MD5

      a6b1af7c558a106078ea147df82e13e3

    • SHA1

      275a5e76aea1365c65ad34132382a9d3e1c07445

    • SHA256

      ebc89503b1729887f5ea5423b334ef1b3ec215386b8c9c656a177f338158d4d1

    • SHA512

      bad3655f9cf40dabc188e0d355f8346cfc4796c0ffc5da7cbbb5cb26d087b373c8e87ec4a7e281543bf4a2ad37c070c1d2599f9b85cc24e2ce5bc9a6269a6aeb

    • SSDEEP

      24576:5rYyiPh6GlRD/FBAZgi04nHH5xGXDx8NFN4Td60tBuyGKq3zZHph/g6A9yROP+Sf:BbiPhYzZHpNOmSRp

    Score
    10/10
    agentteslacollectionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks