Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
0b01741f707a7204f673814ed3257bd0.bin
-
Size
508KB
-
Sample
230706-besg4ahh3s
-
MD5
70a679cd432f23c08e79dd20387646b3
-
SHA1
d0d3c5b576065e58b2c0af66a60ff49586e33573
-
SHA256
8c8397761c4e2012182a3d91010f80ac7d990524f055d7f83ab95f675df50e45
-
SHA512
23a53d899dc73efbb68ab43ea7d12321f4ab59b704911fe2c642c3f3ff589a45ff5a62f8928afe3eb9130a6b395bad725de12d872afddd8d04e1a0e90cbd4913
-
SSDEEP
12288:k+FpGQdPdxiYx2GoZX2CgsI2UcX2RTWcq7DsVhWeAds034tVT:k+F1PdmGDnu2RTWkZvVT
Static task
static1
Behavioral task
behavioral1
Sample
e3a4d27630c1d1f5f57a8d490047380ffd6f813b6ffa9eb554632ac915a61447.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
e3a4d27630c1d1f5f57a8d490047380ffd6f813b6ffa9eb554632ac915a61447.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
sh003.webhostbox.net - Port:
587 - Username:
[email protected] - Password:
bl e ss ing 2 0 2 3 - Email To:
[email protected]
Targets
-
-
Target
e3a4d27630c1d1f5f57a8d490047380ffd6f813b6ffa9eb554632ac915a61447.exe
-
Size
831KB
-
MD5
0b01741f707a7204f673814ed3257bd0
-
SHA1
e3a26c4e967ea85eeb07bede52ad99d07b1f5258
-
SHA256
e3a4d27630c1d1f5f57a8d490047380ffd6f813b6ffa9eb554632ac915a61447
-
SHA512
be5c717978de2422c6b227fca411a3da058429546502f1911cc2a85c11d2b4b0ea858e8d0f3ca5bc1d3c5a6da3378190e2e676157299777e0edb01c297ed428a
-
SSDEEP
12288:cfGb3nsa9x1LsqbkGweSJ3hs0bUZEZ1BthUhCmdjRlilfa6PkQ4:UGwJ3hfbUyt0lOc77
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-