Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    SecuriteInfo.com.Trojan.Inject4.59820.32080.32599

  • Size

    914KB

  • Sample

    231117-p2d5waae2w

  • MD5

    1ff0f2d8838bab1d052908709ae4d37b

  • SHA1

    9499f91fdfe212325d190509d357a44d6e2b26fd

  • SHA256

    6cb36f0f7e413667ee3a0fbc42e6c95e08853e1025f8382270e63e91dad0a0fb

  • SHA512

    513ef448e336b73c7a189d457a8cc32d527c4b668bf2ecbfb460033cdee8ad4f3d6199f729e1e50007e7f1ea9ac2247d9ab5693b8335a2df71ea18d181da5f97

  • SSDEEP

    24576:D1qiuGPkRxjps8E+1vQixH9sI5HUW3CM:D1qiuGPOjps1ivsi0W

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      SecuriteInfo.com.Trojan.Inject4.59820.32080.32599

    • Size

      914KB

    • MD5

      1ff0f2d8838bab1d052908709ae4d37b

    • SHA1

      9499f91fdfe212325d190509d357a44d6e2b26fd

    • SHA256

      6cb36f0f7e413667ee3a0fbc42e6c95e08853e1025f8382270e63e91dad0a0fb

    • SHA512

      513ef448e336b73c7a189d457a8cc32d527c4b668bf2ecbfb460033cdee8ad4f3d6199f729e1e50007e7f1ea9ac2247d9ab5693b8335a2df71ea18d181da5f97

    • SSDEEP

      24576:D1qiuGPkRxjps8E+1vQixH9sI5HUW3CM:D1qiuGPOjps1ivsi0W

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks