Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    6Rq2jH2LqNWL4Ms.exe

  • Size

    953.7MB

  • Sample

    231102-nkt94aba5w

  • MD5

    d62b6cd8efefc35a296dce538406b0bc

  • SHA1

    6eed2f5cfaa4be37f415ffc7e7ca0be3c8fa666b

  • SHA256

    2c6806c595851c8586c1b1fd617422979732675a4ad0b383527909b839e58b66

  • SHA512

    377526e54bc9c9290f8bafe4900b3afddd56b0b34360e50de885d297c2f425f01fd6d471f7151add0f36c64184725ec5d79956550a2ea21f5352ea2415f908fd

  • SSDEEP

    12288:Tbp4GlTGNnvQvUGeNOcGeEEWygssurJ0w/xMQpEiR2qYt6:TV4CGOvUvNOcW1ssE0ExMQpEHr

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6914781013:AAFw5Lm73ahTisnJp0Jdlgo14kV_jOgJDAE/

Targets

    • Target

      6Rq2jH2LqNWL4Ms.exe

    • Size

      953.7MB

    • MD5

      d62b6cd8efefc35a296dce538406b0bc

    • SHA1

      6eed2f5cfaa4be37f415ffc7e7ca0be3c8fa666b

    • SHA256

      2c6806c595851c8586c1b1fd617422979732675a4ad0b383527909b839e58b66

    • SHA512

      377526e54bc9c9290f8bafe4900b3afddd56b0b34360e50de885d297c2f425f01fd6d471f7151add0f36c64184725ec5d79956550a2ea21f5352ea2415f908fd

    • SSDEEP

      12288:Tbp4GlTGNnvQvUGeNOcGeEEWygssurJ0w/xMQpEiR2qYt6:TV4CGOvUvNOcW1ssE0ExMQpEHr

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks