Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    BANK COPY.exe

  • Size

    549KB

  • Sample

    230904-m289xaff3z

  • MD5

    cc9408eff115ec6b750c751d1fc1093f

  • SHA1

    559f96055dafaa4e46e0b594a5b748687dabbe8c

  • SHA256

    2985214c0fbae1739d06009de458f7c2c1b38d4057f9a841e00922abe2c55103

  • SHA512

    5aab5ad46b687930d17895fe44522b3930f2798c87af59c54b0587ec51fe73788027e82c3d81ed87ce7ab7db37d36bf1ab9cbbe56ba7ec4f699a3efec6fa99e6

  • SSDEEP

    12288:EPsCaf/JbuqHHuE1dS68Fd58sDlN/q/afcJetqd6kuPjaz:uaf/J5uIS6818sLaCYd07az

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      BANK COPY.exe

    • Size

      549KB

    • MD5

      cc9408eff115ec6b750c751d1fc1093f

    • SHA1

      559f96055dafaa4e46e0b594a5b748687dabbe8c

    • SHA256

      2985214c0fbae1739d06009de458f7c2c1b38d4057f9a841e00922abe2c55103

    • SHA512

      5aab5ad46b687930d17895fe44522b3930f2798c87af59c54b0587ec51fe73788027e82c3d81ed87ce7ab7db37d36bf1ab9cbbe56ba7ec4f699a3efec6fa99e6

    • SSDEEP

      12288:EPsCaf/JbuqHHuE1dS68Fd58sDlN/q/afcJetqd6kuPjaz:uaf/J5uIS6818sLaCYd07az

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks