Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

SecuriteIn...71.exe

windows7-x64

1

SecuriteIn...71.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.DropperX-gen.25733.17471.exe

  • Size

    291KB

  • Sample

    230824-d2g1zsbb8t

  • MD5

    038409d8dd6fc2fa2925291ec2e135e8

  • SHA1

    a6a26917174a91761f2ad6db0ab105d03ed1935a

  • SHA256

    4ee20e6e4d1b18999911454d2672a5b97914712e7f8c4fd2a8156a2c455d0023

  • SHA512

    1d0ebd3422351ca8e6808d969f37f7d05edf6880e69e29aff11452d40143dd184c544662fb3653a921a1c8310095f1193ec28b79003709f8d2970faf72c804b5

  • SSDEEP

    6144:IMI1zrYcxmZZvK9F+oRZNSwAJnBihtt1qeG8vNBehdOkMORyhacvS9I/0ms9Yxh4:IMI14cIZZvK9lHNSwAMqeG8vNMhAh2B

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      SecuriteInfo.com.Win32.DropperX-gen.25733.17471.exe

    • Size

      291KB

    • MD5

      038409d8dd6fc2fa2925291ec2e135e8

    • SHA1

      a6a26917174a91761f2ad6db0ab105d03ed1935a

    • SHA256

      4ee20e6e4d1b18999911454d2672a5b97914712e7f8c4fd2a8156a2c455d0023

    • SHA512

      1d0ebd3422351ca8e6808d969f37f7d05edf6880e69e29aff11452d40143dd184c544662fb3653a921a1c8310095f1193ec28b79003709f8d2970faf72c804b5

    • SSDEEP

      6144:IMI1zrYcxmZZvK9F+oRZNSwAJnBihtt1qeG8vNBehdOkMORyhacvS9I/0ms9Yxh4:IMI14cIZZvK9lHNSwAMqeG8vNMhAh2B

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks