Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    POexe.exe

  • Size

    609KB

  • Sample

    230704-qjyx1afa2v

  • MD5

    3f7a1be06f9e81b2a64cd84dbf00039d

  • SHA1

    adb70d3b81ac28fbb3b277fe7e75bdbd52ebada0

  • SHA256

    c95706e9e36c1532f18cb25f4f98abab9164da9cfd25965f76ee3187dd95494e

  • SHA512

    aeef19e54d7bf1c1071c1ba8585a3a8b010dbb5b43d04f65733f6b07030ed582563a6dd95898140ba45e70623c9bd564ddd4f6169136f4bdcb9528f5204f20fc

  • SSDEEP

    12288:5/DzR6Raa0ydviUOqk+AwvW/TBAIKmbx/1G18Zx4m:ZsRaa0jUK+Aw+/1AIKmx1NZx4m

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5757748605:AAHI9rc9CYWMivLuImcQ_ENpJzN7mD9DYis/

Targets

    • Target

      POexe.exe

    • Size

      609KB

    • MD5

      3f7a1be06f9e81b2a64cd84dbf00039d

    • SHA1

      adb70d3b81ac28fbb3b277fe7e75bdbd52ebada0

    • SHA256

      c95706e9e36c1532f18cb25f4f98abab9164da9cfd25965f76ee3187dd95494e

    • SHA512

      aeef19e54d7bf1c1071c1ba8585a3a8b010dbb5b43d04f65733f6b07030ed582563a6dd95898140ba45e70623c9bd564ddd4f6169136f4bdcb9528f5204f20fc

    • SSDEEP

      12288:5/DzR6Raa0ydviUOqk+AwvW/TBAIKmbx/1G18Zx4m:ZsRaa0jUK+Aw+/1AIKmx1NZx4m

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks