Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d66e661dc2d6a04138131333caa6c77372ef7901a225b50684ca9ee3c3a1a09cexe_JC.exe

  • Size

    643KB

  • Sample

    231005-xjhpcaec2v

  • MD5

    3bd08c421079b536a25a8e5f7d03d3d8

  • SHA1

    d5c826f9411ab8e5429576489b0d8dcd32f30113

  • SHA256

    d66e661dc2d6a04138131333caa6c77372ef7901a225b50684ca9ee3c3a1a09c

  • SHA512

    749240952b26506a37bc237d99e8af8b2afdbf7574f26f6cb94c27dc9086a42daa45e86feccdf7d3ddb591c7a95f8f9a77b942c1b2820f0a18e08917b328890b

  • SSDEEP

    12288:/JysnoROJN5Kd2wUc2G4OxLm0hrqlUTOjOTCQSBZ7J:hoqN5KdOc2G4KiYqWwZ

Malware Config

Extracted

Family

agenttesla

C2

https://discordapp.com/api/webhooks/1152044580930330757/oS70yKF0Llptf4YanIHw96VR0y5casQRgGeqSg4wYVIGp4oTqb9S_TPlww6YsZeWt2S3

Targets

    • Target

      d66e661dc2d6a04138131333caa6c77372ef7901a225b50684ca9ee3c3a1a09cexe_JC.exe

    • Size

      643KB

    • MD5

      3bd08c421079b536a25a8e5f7d03d3d8

    • SHA1

      d5c826f9411ab8e5429576489b0d8dcd32f30113

    • SHA256

      d66e661dc2d6a04138131333caa6c77372ef7901a225b50684ca9ee3c3a1a09c

    • SHA512

      749240952b26506a37bc237d99e8af8b2afdbf7574f26f6cb94c27dc9086a42daa45e86feccdf7d3ddb591c7a95f8f9a77b942c1b2820f0a18e08917b328890b

    • SSDEEP

      12288:/JysnoROJN5Kd2wUc2G4OxLm0hrqlUTOjOTCQSBZ7J:hoqN5KdOc2G4KiYqWwZ

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks