Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6e661564df86bdba62028ad317f579b9ee7d91b4d131b26ea3efad24992a065c_JC.exe
-
Size
968KB
-
Sample
230826-r3bggsbb32
-
MD5
513142f5bce52f2ee107ea67c999d39b
-
SHA1
303c82a2f3d32f625bfbc3bd6d6c03b18c9fd354
-
SHA256
6e661564df86bdba62028ad317f579b9ee7d91b4d131b26ea3efad24992a065c
-
SHA512
b2fe8fdc970a500fe2fa12a4bb971c801d99aef20434c5928629627f6d9f708124704d135790aa757f26e8dc130564770754411ec05a3fb9038aadd26dcd166c
-
SSDEEP
12288:mK4JuxVWU6i5dKSWrVTgmSkN8JKRQmZ2CWPeCDv4m:Jy8VW526VBImZ23PZ
Static task
static1
Behavioral task
behavioral1
Sample
6e661564df86bdba62028ad317f579b9ee7d91b4d131b26ea3efad24992a065c_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
6e661564df86bdba62028ad317f579b9ee7d91b4d131b26ea3efad24992a065c_JC.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
kV$bSqJ1 daniel - Email To:
[email protected]
Targets
-
-
Target
6e661564df86bdba62028ad317f579b9ee7d91b4d131b26ea3efad24992a065c_JC.exe
-
Size
968KB
-
MD5
513142f5bce52f2ee107ea67c999d39b
-
SHA1
303c82a2f3d32f625bfbc3bd6d6c03b18c9fd354
-
SHA256
6e661564df86bdba62028ad317f579b9ee7d91b4d131b26ea3efad24992a065c
-
SHA512
b2fe8fdc970a500fe2fa12a4bb971c801d99aef20434c5928629627f6d9f708124704d135790aa757f26e8dc130564770754411ec05a3fb9038aadd26dcd166c
-
SSDEEP
12288:mK4JuxVWU6i5dKSWrVTgmSkN8JKRQmZ2CWPeCDv4m:Jy8VW526VBImZ23PZ
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-