Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    33KB

  • Sample

    230918-zekn9aeh23

  • MD5

    adf77eedf1227b9e20f18ebc67a18e99

  • SHA1

    4de5e9da6efa822dee0873201cb881e2196ac85b

  • SHA256

    e9e7e9651f55ae882e793b6be4d4125a606f52a27f1c399e7896cb84bd76bd8c

  • SHA512

    15d1cd55d09b0d7322752c5500ec2ed1cb1d7ea3764ba79931ef4c6b4ec6f3e9c17606bc25ac2759508a804ad680f4835db935ecc77cf20554c19897b2c2efa4

  • SSDEEP

    768:L1hP2sZ03Ih+76146qB0jRaNG+mNJij7cG66:L/2iDqB0jMN38ijm6

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      file.exe

    • Size

      33KB

    • MD5

      adf77eedf1227b9e20f18ebc67a18e99

    • SHA1

      4de5e9da6efa822dee0873201cb881e2196ac85b

    • SHA256

      e9e7e9651f55ae882e793b6be4d4125a606f52a27f1c399e7896cb84bd76bd8c

    • SHA512

      15d1cd55d09b0d7322752c5500ec2ed1cb1d7ea3764ba79931ef4c6b4ec6f3e9c17606bc25ac2759508a804ad680f4835db935ecc77cf20554c19897b2c2efa4

    • SSDEEP

      768:L1hP2sZ03Ih+76146qB0jRaNG+mNJij7cG66:L/2iDqB0jMN38ijm6

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Downloads MZ/PE file

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks