Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
TT copy.exe
-
Size
600KB
-
Sample
231006-qvwl1seb33
-
MD5
ea77a015c9e55ab7f3ed3619f1620394
-
SHA1
197a1f5dedf523bbca3bb197cf6473c5ed907d15
-
SHA256
0c250b21da631c5356630ff3d17f09a6da38a4c619f534b8f0be9d360707c9d4
-
SHA512
871846897ec3f52bcf3ecd9e0f051d6e5a5aea6faa710bd6dad750ae398944c5257df83916e399645eacb6dd091085672c5131ca76172835e424ca755d534c74
-
SSDEEP
12288:O0iW7s9Gw72TI6DZxcLsirGpb1PRE9QdC3SVwk3+v0cB10bG9:O0iW7s9GeekFrGXKxUw7v0cB1t
Static task
static1
Behavioral task
behavioral1
Sample
TT copy.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
TT copy.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
kV$bSqJ1 daniel - Email To:
[email protected]
Targets
-
-
Target
TT copy.exe
-
Size
600KB
-
MD5
ea77a015c9e55ab7f3ed3619f1620394
-
SHA1
197a1f5dedf523bbca3bb197cf6473c5ed907d15
-
SHA256
0c250b21da631c5356630ff3d17f09a6da38a4c619f534b8f0be9d360707c9d4
-
SHA512
871846897ec3f52bcf3ecd9e0f051d6e5a5aea6faa710bd6dad750ae398944c5257df83916e399645eacb6dd091085672c5131ca76172835e424ca755d534c74
-
SSDEEP
12288:O0iW7s9Gw72TI6DZxcLsirGpb1PRE9QdC3SVwk3+v0cB10bG9:O0iW7s9GeekFrGXKxUw7v0cB1t
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-