Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a95f9a75b4460b7983279a879c9ec0f9.exe
-
Size
620KB
-
Sample
230719-hgxcdshb2z
-
MD5
a95f9a75b4460b7983279a879c9ec0f9
-
SHA1
b2d50a2baca82a5a900a0cdc83921ee33ec5f558
-
SHA256
f591f3b46cc1844550906abe587a1d82b96b37bac5621c1937ab8b0552258417
-
SHA512
6217a9a46537df1afb6f837818f4a5a49abaf08cd1310810e3683ef5bbe141b65ff83f82d2142f30f3fa95bce2dcd96e788dd82451f0d144090ed4cb7dee825f
-
SSDEEP
12288:0PYPfY7NWu5uZY6rmFpXUhNUSKpOILx6Peo:0PYPgwuKYtwUfO0x6Pe
Static task
static1
Behavioral task
behavioral1
Sample
a95f9a75b4460b7983279a879c9ec0f9.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a95f9a75b4460b7983279a879c9ec0f9.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.kingdomofmiso.com - Port:
587 - Username:
[email protected] - Password:
nrU*QuBIa6HR - Email To:
[email protected]
Targets
-
-
Target
a95f9a75b4460b7983279a879c9ec0f9.exe
-
Size
620KB
-
MD5
a95f9a75b4460b7983279a879c9ec0f9
-
SHA1
b2d50a2baca82a5a900a0cdc83921ee33ec5f558
-
SHA256
f591f3b46cc1844550906abe587a1d82b96b37bac5621c1937ab8b0552258417
-
SHA512
6217a9a46537df1afb6f837818f4a5a49abaf08cd1310810e3683ef5bbe141b65ff83f82d2142f30f3fa95bce2dcd96e788dd82451f0d144090ed4cb7dee825f
-
SSDEEP
12288:0PYPfY7NWu5uZY6rmFpXUhNUSKpOILx6Peo:0PYPgwuKYtwUfO0x6Pe
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-