Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

24020238 R...77.exe

windows7-x64

1

24020238 R...77.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    24020238 RVOOIN-16-0077.rar

  • Size

    94KB

  • Sample

    230828-qmt38abb92

  • MD5

    38a6216a223d35a6a2d2b1b04d8cbb22

  • SHA1

    04b3e579c926c4a5594dacbf675df27860f0bedc

  • SHA256

    39ee7c2c7adc0a85af20d526c5df56658e068f415f1fe8c5b441fa5ed7800cbf

  • SHA512

    8f6ac970202a5c8327893351096316723cba111cdd609e4c547c6d5086b884de1a2982e1ec242cbd0e8fa98de763e2dfb566084a689e27a9803b8812f01a2ea9

  • SSDEEP

    1536:aCLb/JHG/mTrXiM7lrVzi7ZVzdknWmG2Ej2DfYrMJdVEd6g/FBYf+B7hh/lxLyTx:aIG/mTrSONitVaWmAjxMJEb0f+B77/Kt

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      24020238 RVOOIN-16-0077.exe

    • Size

      221KB

    • MD5

      1b609ec45815de8ae1b665dfa9f374d8

    • SHA1

      086ad42a52b239902e0205d8399a3265dacdc970

    • SHA256

      e1d5abc7c22da2d3def88a5118efc2f1c6349549654dec4d65ad477218244420

    • SHA512

      d0480f7162e8293b355e8c0a08bddf8bc3a040677bb3546639f69f4d86eeee09fce767738d281ea0acf1e8ed058771e0090db03411c3041b7b567996f77547f9

    • SSDEEP

      6144:BmANehKKjF+cuM/GM8I0nbu7hWEECv4r+ViK:BmANehKo+cuM/GMsnbuoEECv8

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks