Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

e3a4d27630...47.exe

windows7-x64

10

e3a4d27630...47.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b01741f707a7204f673814ed3257bd0.bin

  • Size

    508KB

  • Sample

    230706-besg4ahh3s

  • MD5

    70a679cd432f23c08e79dd20387646b3

  • SHA1

    d0d3c5b576065e58b2c0af66a60ff49586e33573

  • SHA256

    8c8397761c4e2012182a3d91010f80ac7d990524f055d7f83ab95f675df50e45

  • SHA512

    23a53d899dc73efbb68ab43ea7d12321f4ab59b704911fe2c642c3f3ff589a45ff5a62f8928afe3eb9130a6b395bad725de12d872afddd8d04e1a0e90cbd4913

  • SSDEEP

    12288:k+FpGQdPdxiYx2GoZX2CgsI2UcX2RTWcq7DsVhWeAds034tVT:k+F1PdmGDnu2RTWkZvVT

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      e3a4d27630c1d1f5f57a8d490047380ffd6f813b6ffa9eb554632ac915a61447.exe

    • Size

      831KB

    • MD5

      0b01741f707a7204f673814ed3257bd0

    • SHA1

      e3a26c4e967ea85eeb07bede52ad99d07b1f5258

    • SHA256

      e3a4d27630c1d1f5f57a8d490047380ffd6f813b6ffa9eb554632ac915a61447

    • SHA512

      be5c717978de2422c6b227fca411a3da058429546502f1911cc2a85c11d2b4b0ea858e8d0f3ca5bc1d3c5a6da3378190e2e676157299777e0edb01c297ed428a

    • SSDEEP

      12288:cfGb3nsa9x1LsqbkGweSJ3hs0bUZEZ1BthUhCmdjRlilfa6PkQ4:UGwJ3hfbUyt0lOc77

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks