Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    337c891ea747e73930dd5b2f27921720a905e3531ab38c89f5f7b0e208b20dae.exe

  • Size

    3.9MB

  • Sample

    231101-rt5nzabe86

  • MD5

    8aa7f15a75d78a3029a3da0ba80282c8

  • SHA1

    47249bc395517fc6ca5cf0837c6a66d551749a93

  • SHA256

    337c891ea747e73930dd5b2f27921720a905e3531ab38c89f5f7b0e208b20dae

  • SHA512

    f17c78990077f8450e71a0c6e984ddfab9f7b55c9898999d3e8cb80d7925ca02432962a35fbc74bebc955a370082d9754f9a641a79f26ebf1dcf77a004b37369

  • SSDEEP

    49152:9eA3k5ul6MhfuPQoCGUiKxdszvdAQgFPhEyzYKsG6sVet39OOK:f6kAz9GM4

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6603930847:AAFEPpt87jNrswsoxRziEquzc7QyaetKssE/

Targets

    • Target

      337c891ea747e73930dd5b2f27921720a905e3531ab38c89f5f7b0e208b20dae.exe

    • Size

      3.9MB

    • MD5

      8aa7f15a75d78a3029a3da0ba80282c8

    • SHA1

      47249bc395517fc6ca5cf0837c6a66d551749a93

    • SHA256

      337c891ea747e73930dd5b2f27921720a905e3531ab38c89f5f7b0e208b20dae

    • SHA512

      f17c78990077f8450e71a0c6e984ddfab9f7b55c9898999d3e8cb80d7925ca02432962a35fbc74bebc955a370082d9754f9a641a79f26ebf1dcf77a004b37369

    • SSDEEP

      49152:9eA3k5ul6MhfuPQoCGUiKxdszvdAQgFPhEyzYKsG6sVet39OOK:f6kAz9GM4

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks