Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
337c891ea747e73930dd5b2f27921720a905e3531ab38c89f5f7b0e208b20dae.exe
-
Size
3.9MB
-
Sample
231101-rt5nzabe86
-
MD5
8aa7f15a75d78a3029a3da0ba80282c8
-
SHA1
47249bc395517fc6ca5cf0837c6a66d551749a93
-
SHA256
337c891ea747e73930dd5b2f27921720a905e3531ab38c89f5f7b0e208b20dae
-
SHA512
f17c78990077f8450e71a0c6e984ddfab9f7b55c9898999d3e8cb80d7925ca02432962a35fbc74bebc955a370082d9754f9a641a79f26ebf1dcf77a004b37369
-
SSDEEP
49152:9eA3k5ul6MhfuPQoCGUiKxdszvdAQgFPhEyzYKsG6sVet39OOK:f6kAz9GM4
Static task
static1
Behavioral task
behavioral1
Sample
337c891ea747e73930dd5b2f27921720a905e3531ab38c89f5f7b0e208b20dae.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
337c891ea747e73930dd5b2f27921720a905e3531ab38c89f5f7b0e208b20dae.exe
Resource
win10v2004-20231025-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6603930847:AAFEPpt87jNrswsoxRziEquzc7QyaetKssE/
Targets
-
-
Target
337c891ea747e73930dd5b2f27921720a905e3531ab38c89f5f7b0e208b20dae.exe
-
Size
3.9MB
-
MD5
8aa7f15a75d78a3029a3da0ba80282c8
-
SHA1
47249bc395517fc6ca5cf0837c6a66d551749a93
-
SHA256
337c891ea747e73930dd5b2f27921720a905e3531ab38c89f5f7b0e208b20dae
-
SHA512
f17c78990077f8450e71a0c6e984ddfab9f7b55c9898999d3e8cb80d7925ca02432962a35fbc74bebc955a370082d9754f9a641a79f26ebf1dcf77a004b37369
-
SSDEEP
49152:9eA3k5ul6MhfuPQoCGUiKxdszvdAQgFPhEyzYKsG6sVet39OOK:f6kAz9GM4
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-