Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
satın alma emri.exe
-
Size
456KB
-
Sample
230828-qssscabc47
-
MD5
2c0f7daa0637923f321617d6bbc2c968
-
SHA1
da5f7fca6da24d2f065d68bc32a127089b7c42ed
-
SHA256
67a1d95ac501b3239795c12bdebe20853519e92810d5124bff570a5f9001d440
-
SHA512
89098cf7e98ad22b56ce7415db68a26afa1f3bd48c3611def7edb08242045140dd14de94e464840e36d7efb1ad5d3f72970120dd0d1e607359e2d6a0db6be3c7
-
SSDEEP
6144:z3IaL+ZdLqbt3de/e1L0U0iA3o4U5miBdthFjPLW5eVHtM3RirSdkbrs1aq:z9/p1gUVA3KxjzKeVHyRir5rs1j
Static task
static1
Behavioral task
behavioral1
Sample
satın alma emri.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
satın alma emri.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
agenttesla
https://discordapp.com/api/webhooks/1145251777952886784/YHlqQB8-CLI8j31rwP_EM7zqJEQJXxU_Oj2JYZGz03XJ2vHM4R3mj7a-WhMivxm2KvdV
Targets
-
-
Target
satın alma emri.exe
-
Size
456KB
-
MD5
2c0f7daa0637923f321617d6bbc2c968
-
SHA1
da5f7fca6da24d2f065d68bc32a127089b7c42ed
-
SHA256
67a1d95ac501b3239795c12bdebe20853519e92810d5124bff570a5f9001d440
-
SHA512
89098cf7e98ad22b56ce7415db68a26afa1f3bd48c3611def7edb08242045140dd14de94e464840e36d7efb1ad5d3f72970120dd0d1e607359e2d6a0db6be3c7
-
SSDEEP
6144:z3IaL+ZdLqbt3de/e1L0U0iA3o4U5miBdthFjPLW5eVHtM3RirSdkbrs1aq:z9/p1gUVA3KxjzKeVHyRir5rs1j
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops startup file
-
Suspicious use of SetThreadContext
-