Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
POexe.exe
-
Size
609KB
-
Sample
230704-qjyx1afa2v
-
MD5
3f7a1be06f9e81b2a64cd84dbf00039d
-
SHA1
adb70d3b81ac28fbb3b277fe7e75bdbd52ebada0
-
SHA256
c95706e9e36c1532f18cb25f4f98abab9164da9cfd25965f76ee3187dd95494e
-
SHA512
aeef19e54d7bf1c1071c1ba8585a3a8b010dbb5b43d04f65733f6b07030ed582563a6dd95898140ba45e70623c9bd564ddd4f6169136f4bdcb9528f5204f20fc
-
SSDEEP
12288:5/DzR6Raa0ydviUOqk+AwvW/TBAIKmbx/1G18Zx4m:ZsRaa0jUK+Aw+/1AIKmx1NZx4m
Static task
static1
Behavioral task
behavioral1
Sample
POexe.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
POexe.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5757748605:AAHI9rc9CYWMivLuImcQ_ENpJzN7mD9DYis/
Targets
-
-
Target
POexe.exe
-
Size
609KB
-
MD5
3f7a1be06f9e81b2a64cd84dbf00039d
-
SHA1
adb70d3b81ac28fbb3b277fe7e75bdbd52ebada0
-
SHA256
c95706e9e36c1532f18cb25f4f98abab9164da9cfd25965f76ee3187dd95494e
-
SHA512
aeef19e54d7bf1c1071c1ba8585a3a8b010dbb5b43d04f65733f6b07030ed582563a6dd95898140ba45e70623c9bd564ddd4f6169136f4bdcb9528f5204f20fc
-
SSDEEP
12288:5/DzR6Raa0ydviUOqk+AwvW/TBAIKmbx/1G18Zx4m:ZsRaa0jUK+Aw+/1AIKmx1NZx4m
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-