Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ENQUIRYPR-009583POWER ENERGY.pdf.exe
-
Size
604KB
-
Sample
230918-razcvahg2t
-
MD5
3e01756a6f2ffed6c3ee881233f371ca
-
SHA1
04466fd9c0c40a93c30c3c09a7bfacc5da3d5c51
-
SHA256
eca31a8b84856348ea97f1a1469c8b34f6afc80b79e5a0d40fca44f2a4139d0f
-
SHA512
37afd734c0620c5cc807ea0e46e87d1746dcebdd7cf1e995c50efb1e5b8e0055579430b5b7b3190fd9ac0f1124b62f8fdb8d02618a9a2625804f57d829059b1f
-
SSDEEP
12288:CYnAfDuHOXHWk+qTK8jpPD1CtX2ZifPC2J0Ayf2fCJ:CYng5BxCwifPXJNe2a
Static task
static1
Behavioral task
behavioral1
Sample
ENQUIRYPR-009583POWER ENERGY.pdf.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ENQUIRYPR-009583POWER ENERGY.pdf.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
JUGCRsm9 - Email To:
[email protected]
Targets
-
-
Target
ENQUIRYPR-009583POWER ENERGY.pdf.exe
-
Size
604KB
-
MD5
3e01756a6f2ffed6c3ee881233f371ca
-
SHA1
04466fd9c0c40a93c30c3c09a7bfacc5da3d5c51
-
SHA256
eca31a8b84856348ea97f1a1469c8b34f6afc80b79e5a0d40fca44f2a4139d0f
-
SHA512
37afd734c0620c5cc807ea0e46e87d1746dcebdd7cf1e995c50efb1e5b8e0055579430b5b7b3190fd9ac0f1124b62f8fdb8d02618a9a2625804f57d829059b1f
-
SSDEEP
12288:CYnAfDuHOXHWk+qTK8jpPD1CtX2ZifPC2J0Ayf2fCJ:CYng5BxCwifPXJNe2a
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-