Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    3120fb515a817d8915abf32e676fb1d99a46bcbcae772959364f9957176747b6

  • Size

    612KB

  • Sample

    231014-mxd8zaef72

  • MD5

    5e8a232183ae0767063e0065cce9b9f6

  • SHA1

    f67d919e0f16c0b8ddfb5f27c9a873591e272ad8

  • SHA256

    3120fb515a817d8915abf32e676fb1d99a46bcbcae772959364f9957176747b6

  • SHA512

    78128f52cf1cb72aa243f3f942365e2d8e6da2e064555c9b105b6ea7ab08255c8754677b84f331045424e91d50a28926b7f8ea5a16074015b5bbaebc7c486f4f

  • SSDEEP

    12288:Nq4/TqAHF1OwUUSakr+4VlwnJPADBhL2Tf4NhrObXg5av8aIrri:NqkXY6ElwJPqBhqf4hrOiav8Nfi

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6170712575:AAElPWnx5Qa6DM6VEbCF2EKyxvGg9piYKdM/

Targets

    • Target

      PAYMENT OF OUTSTANDING BILLS.pdf.exe

    • Size

      644KB

    • MD5

      432c2dd84816f93dcb064c273e51fe60

    • SHA1

      6c3c24235db1b66bf265ea3b103a592a5291d44e

    • SHA256

      721ca582a7a8e00d9421c1acaa52906cfe9219cb13be9646b713462e48198c54

    • SHA512

      ee04fbc1756eecc5907fbcda3003ccabaaf1244e20ee6296115e42979df6fcae67a35ccfc2fb995d3ce5f4f37da81892e41bf0ddf277056d038c01b728a69695

    • SSDEEP

      12288:KURF2iNqUCemnN5t3xUIa0bwol55hsqkMTVIAqXvfIKWOr8JCsBJ1D7j2mEVLIE:KCF14WmrjUtoVhsqkMVIpvAKb4teREE

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks