Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6a5ff8d244ae4a460ce972906a3fffd8.exe
-
Size
251KB
-
Sample
231101-n169lafh3w
-
MD5
6a5ff8d244ae4a460ce972906a3fffd8
-
SHA1
6009dd270803e231d787e3dc1f3eb55a698f7fed
-
SHA256
d03a9517cf81eca522f483a8229379002aab4f1067ccf491f7d6cfac62e223f7
-
SHA512
b64291f3bacea9ef8657fd1e53179ca25cadc8c8b0b6774e9ca6fd4f2a83b554eaacfd4fe4bbe1c4d6c64f9302e1c7a3d684f318bc924b435ef304c543955439
-
SSDEEP
6144:lUZ7XXb7v6fsQrGsUO+ZxdQYXBmfwrhGGGGGGGGHGGGGGGGGGGGGGGGGGGGGGGGG:lyGsQX+Zxjty
Static task
static1
Behavioral task
behavioral1
Sample
6a5ff8d244ae4a460ce972906a3fffd8.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
6a5ff8d244ae4a460ce972906a3fffd8.exe
Resource
win10v2004-20231023-en
Malware Config
Extracted
Protocol: smtp- Host:
webmail.trevor22photography.com - Port:
587 - Username:
[email protected] - Password:
Arsenal22@
Extracted
agenttesla
Protocol: smtp- Host:
webmail.trevor22photography.com - Port:
587 - Username:
[email protected] - Password:
Arsenal22@ - Email To:
[email protected]
Targets
-
-
Target
6a5ff8d244ae4a460ce972906a3fffd8.exe
-
Size
251KB
-
MD5
6a5ff8d244ae4a460ce972906a3fffd8
-
SHA1
6009dd270803e231d787e3dc1f3eb55a698f7fed
-
SHA256
d03a9517cf81eca522f483a8229379002aab4f1067ccf491f7d6cfac62e223f7
-
SHA512
b64291f3bacea9ef8657fd1e53179ca25cadc8c8b0b6774e9ca6fd4f2a83b554eaacfd4fe4bbe1c4d6c64f9302e1c7a3d684f318bc924b435ef304c543955439
-
SSDEEP
6144:lUZ7XXb7v6fsQrGsUO+ZxdQYXBmfwrhGGGGGGGGHGGGGGGGGGGGGGGGGGGGGGGGG:lyGsQX+Zxjty
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-