Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
5cf1b3cf7987c16061df1f12f5be01702df47d4d003f4fc7844d36583b0df168.exe
-
Size
699KB
-
Sample
230808-nxv26acc44
-
MD5
b7f78ca0260d9d5702c05055f2317fa5
-
SHA1
34fc4931a1216fe594211943a50b5051b47f309e
-
SHA256
5cf1b3cf7987c16061df1f12f5be01702df47d4d003f4fc7844d36583b0df168
-
SHA512
83221553428e6d0faf69915e5f6972f7a7318ca86a3ccb3fdf173b78fa20a49fae1f945ad09f500f9fc889daf5213d8fe7cb1421bdab0bbb135553234e8958ab
-
SSDEEP
12288:eJmefaynh6z0QM3zmpcSmiy5Znab4ID+DfUcdAA:HeCQ6z0VycRiYtUEA
Static task
static1
Behavioral task
behavioral1
Sample
5cf1b3cf7987c16061df1f12f5be01702df47d4d003f4fc7844d36583b0df168.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
5cf1b3cf7987c16061df1f12f5be01702df47d4d003f4fc7844d36583b0df168.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.cvgunawanplastik.com - Port:
21 - Username:
[email protected] - Password:
nPIeW(xuXTwi
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.cvgunawanplastik.com - Port:
21 - Username:
[email protected] - Password:
nPIeW(xuXTwi
Targets
-
-
Target
5cf1b3cf7987c16061df1f12f5be01702df47d4d003f4fc7844d36583b0df168.exe
-
Size
699KB
-
MD5
b7f78ca0260d9d5702c05055f2317fa5
-
SHA1
34fc4931a1216fe594211943a50b5051b47f309e
-
SHA256
5cf1b3cf7987c16061df1f12f5be01702df47d4d003f4fc7844d36583b0df168
-
SHA512
83221553428e6d0faf69915e5f6972f7a7318ca86a3ccb3fdf173b78fa20a49fae1f945ad09f500f9fc889daf5213d8fe7cb1421bdab0bbb135553234e8958ab
-
SSDEEP
12288:eJmefaynh6z0QM3zmpcSmiy5Znab4ID+DfUcdAA:HeCQ6z0VycRiYtUEA
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-