Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
d66e661dc2d6a04138131333caa6c77372ef7901a225b50684ca9ee3c3a1a09cexe_JC.exe
-
Size
643KB
-
Sample
231005-xjhpcaec2v
-
MD5
3bd08c421079b536a25a8e5f7d03d3d8
-
SHA1
d5c826f9411ab8e5429576489b0d8dcd32f30113
-
SHA256
d66e661dc2d6a04138131333caa6c77372ef7901a225b50684ca9ee3c3a1a09c
-
SHA512
749240952b26506a37bc237d99e8af8b2afdbf7574f26f6cb94c27dc9086a42daa45e86feccdf7d3ddb591c7a95f8f9a77b942c1b2820f0a18e08917b328890b
-
SSDEEP
12288:/JysnoROJN5Kd2wUc2G4OxLm0hrqlUTOjOTCQSBZ7J:hoqN5KdOc2G4KiYqWwZ
Static task
static1
Behavioral task
behavioral1
Sample
d66e661dc2d6a04138131333caa6c77372ef7901a225b50684ca9ee3c3a1a09cexe_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d66e661dc2d6a04138131333caa6c77372ef7901a225b50684ca9ee3c3a1a09cexe_JC.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
agenttesla
https://discordapp.com/api/webhooks/1152044580930330757/oS70yKF0Llptf4YanIHw96VR0y5casQRgGeqSg4wYVIGp4oTqb9S_TPlww6YsZeWt2S3
Targets
-
-
Target
d66e661dc2d6a04138131333caa6c77372ef7901a225b50684ca9ee3c3a1a09cexe_JC.exe
-
Size
643KB
-
MD5
3bd08c421079b536a25a8e5f7d03d3d8
-
SHA1
d5c826f9411ab8e5429576489b0d8dcd32f30113
-
SHA256
d66e661dc2d6a04138131333caa6c77372ef7901a225b50684ca9ee3c3a1a09c
-
SHA512
749240952b26506a37bc237d99e8af8b2afdbf7574f26f6cb94c27dc9086a42daa45e86feccdf7d3ddb591c7a95f8f9a77b942c1b2820f0a18e08917b328890b
-
SSDEEP
12288:/JysnoROJN5Kd2wUc2G4OxLm0hrqlUTOjOTCQSBZ7J:hoqN5KdOc2G4KiYqWwZ
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-