Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

confirmation.exe

windows7-x64

3

confirmation.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    confirmation.exe

  • Size

    835KB

  • Sample

    231116-rsx8hacd34

  • MD5

    9c7aef281dce8b4681588d60bdab153c

  • SHA1

    a4ac0832c3dfda05c1196ad3edf753dcd26f7ac0

  • SHA256

    7045c1465bc70e0f8a8eaac0515b457496c9641e7ce11fdbc1dab8e8ee08426e

  • SHA512

    802357632270f4bd1beb223d70ed5b86bb5355b58fc3564c99d5a34e4ca3323e1202041ac038134e1a893321e3d7fd2c34cf4aa0ee64c39ca49c652813f54117

  • SSDEEP

    12288:cuP2w40dOrytOTLRvORP3usgih7fk5pGiFiHQSM72YiGDP7r9r/+pppppppppppP:vF4ELttPmi7oFiwS1YdD1q

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      confirmation.exe

    • Size

      835KB

    • MD5

      9c7aef281dce8b4681588d60bdab153c

    • SHA1

      a4ac0832c3dfda05c1196ad3edf753dcd26f7ac0

    • SHA256

      7045c1465bc70e0f8a8eaac0515b457496c9641e7ce11fdbc1dab8e8ee08426e

    • SHA512

      802357632270f4bd1beb223d70ed5b86bb5355b58fc3564c99d5a34e4ca3323e1202041ac038134e1a893321e3d7fd2c34cf4aa0ee64c39ca49c652813f54117

    • SSDEEP

      12288:cuP2w40dOrytOTLRvORP3usgih7fk5pGiFiHQSM72YiGDP7r9r/+pppppppppppP:vF4ELttPmi7oFiwS1YdD1q

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks