Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
audiodgs.exe
-
Size
608KB
-
Sample
231003-g6556aaf24
-
MD5
bb7de5ae335e010647c6d775a6b5ba65
-
SHA1
34fc011c6b4d9e2268620a1dd40413127c09a275
-
SHA256
f5970e4e030d40597a3f67287136f2044c51354e333008c8455c668622ddbfd1
-
SHA512
ffd9ab82fdc60a215943070410ba297cc844e4da5beb4b253b40c49e92ba0973ed0069aa5850eda1a45f0e142ed15c2c43097ae24afedeaa66793daa5792a1a4
-
SSDEEP
12288:NMYnQ3j67SESV1eXl8OhA90X91cYWTBnNVKGML4miAiesWUMGanQeL6+AF5GZv9T:NBX9KrFnNVNbAiHyhyF5Gt9HGr70
Static task
static1
Behavioral task
behavioral1
Sample
audiodgs.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
audiodgs.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.zqamcx.com - Port:
587 - Username:
[email protected] - Password:
method5000@ - Email To:
[email protected]
Targets
-
-
Target
audiodgs.exe
-
Size
608KB
-
MD5
bb7de5ae335e010647c6d775a6b5ba65
-
SHA1
34fc011c6b4d9e2268620a1dd40413127c09a275
-
SHA256
f5970e4e030d40597a3f67287136f2044c51354e333008c8455c668622ddbfd1
-
SHA512
ffd9ab82fdc60a215943070410ba297cc844e4da5beb4b253b40c49e92ba0973ed0069aa5850eda1a45f0e142ed15c2c43097ae24afedeaa66793daa5792a1a4
-
SSDEEP
12288:NMYnQ3j67SESV1eXl8OhA90X91cYWTBnNVKGML4miAiesWUMGanQeL6+AF5GZv9T:NBX9KrFnNVNbAiHyhyF5Gt9HGr70
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-