Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
3120fb515a817d8915abf32e676fb1d99a46bcbcae772959364f9957176747b6
-
Size
612KB
-
Sample
231014-mxd8zaef72
-
MD5
5e8a232183ae0767063e0065cce9b9f6
-
SHA1
f67d919e0f16c0b8ddfb5f27c9a873591e272ad8
-
SHA256
3120fb515a817d8915abf32e676fb1d99a46bcbcae772959364f9957176747b6
-
SHA512
78128f52cf1cb72aa243f3f942365e2d8e6da2e064555c9b105b6ea7ab08255c8754677b84f331045424e91d50a28926b7f8ea5a16074015b5bbaebc7c486f4f
-
SSDEEP
12288:Nq4/TqAHF1OwUUSakr+4VlwnJPADBhL2Tf4NhrObXg5av8aIrri:NqkXY6ElwJPqBhqf4hrOiav8Nfi
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT OF OUTSTANDING BILLS.pdf.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
PAYMENT OF OUTSTANDING BILLS.pdf.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6170712575:AAElPWnx5Qa6DM6VEbCF2EKyxvGg9piYKdM/
Targets
-
-
Target
PAYMENT OF OUTSTANDING BILLS.pdf.exe
-
Size
644KB
-
MD5
432c2dd84816f93dcb064c273e51fe60
-
SHA1
6c3c24235db1b66bf265ea3b103a592a5291d44e
-
SHA256
721ca582a7a8e00d9421c1acaa52906cfe9219cb13be9646b713462e48198c54
-
SHA512
ee04fbc1756eecc5907fbcda3003ccabaaf1244e20ee6296115e42979df6fcae67a35ccfc2fb995d3ce5f4f37da81892e41bf0ddf277056d038c01b728a69695
-
SSDEEP
12288:KURF2iNqUCemnN5t3xUIa0bwol55hsqkMTVIAqXvfIKWOr8JCsBJ1D7j2mEVLIE:KCF14WmrjUtoVhsqkMVIpvAKb4teREE
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-