Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0cdf3f70618d7d304ea20a4319eb6a56173b3e46134aec966f55b20f5505eb94_JC.exe

  • Size

    624KB

  • Sample

    231011-klbycsbh5w

  • MD5

    8fb5ca22085eabbe78929ffacb78cbd9

  • SHA1

    c68788c4364fce787f78bb228ab02db3c3ddc226

  • SHA256

    0cdf3f70618d7d304ea20a4319eb6a56173b3e46134aec966f55b20f5505eb94

  • SHA512

    0c7137e8db9cb018b555faca6e67e94929e62757400f68b5f23888e31aceb07a6a318abf58b88f509a28c5b2cf95029cae2e897a20c4bd0f5841d97ed0d2bc70

  • SSDEEP

    12288:twx+Uw+MMMDMMMBCUyaJ5GUbT+4aqGvjYUbJ1NFIu5qVMjW28Myv:qMMMDMMMBCKJQUbT+BqcbHItVMj98P

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      0cdf3f70618d7d304ea20a4319eb6a56173b3e46134aec966f55b20f5505eb94_JC.exe

    • Size

      624KB

    • MD5

      8fb5ca22085eabbe78929ffacb78cbd9

    • SHA1

      c68788c4364fce787f78bb228ab02db3c3ddc226

    • SHA256

      0cdf3f70618d7d304ea20a4319eb6a56173b3e46134aec966f55b20f5505eb94

    • SHA512

      0c7137e8db9cb018b555faca6e67e94929e62757400f68b5f23888e31aceb07a6a318abf58b88f509a28c5b2cf95029cae2e897a20c4bd0f5841d97ed0d2bc70

    • SSDEEP

      12288:twx+Uw+MMMDMMMBCUyaJ5GUbT+4aqGvjYUbJ1NFIu5qVMjW28Myv:qMMMDMMMBCKJQUbT+BqcbHItVMj98P

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks