Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
SecuriteInfo.com.Trojan.Inject4.59820.32080.32599
-
Size
914KB
-
Sample
231117-p2d5waae2w
-
MD5
1ff0f2d8838bab1d052908709ae4d37b
-
SHA1
9499f91fdfe212325d190509d357a44d6e2b26fd
-
SHA256
6cb36f0f7e413667ee3a0fbc42e6c95e08853e1025f8382270e63e91dad0a0fb
-
SHA512
513ef448e336b73c7a189d457a8cc32d527c4b668bf2ecbfb460033cdee8ad4f3d6199f729e1e50007e7f1ea9ac2247d9ab5693b8335a2df71ea18d181da5f97
-
SSDEEP
24576:D1qiuGPkRxjps8E+1vQixH9sI5HUW3CM:D1qiuGPOjps1ivsi0W
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mgsales.net - Port:
587 - Username:
[email protected] - Password:
.L&tA{$_f4+t - Email To:
[email protected]
Targets
-
-
Target
SecuriteInfo.com.Trojan.Inject4.59820.32080.32599
-
Size
914KB
-
MD5
1ff0f2d8838bab1d052908709ae4d37b
-
SHA1
9499f91fdfe212325d190509d357a44d6e2b26fd
-
SHA256
6cb36f0f7e413667ee3a0fbc42e6c95e08853e1025f8382270e63e91dad0a0fb
-
SHA512
513ef448e336b73c7a189d457a8cc32d527c4b668bf2ecbfb460033cdee8ad4f3d6199f729e1e50007e7f1ea9ac2247d9ab5693b8335a2df71ea18d181da5f97
-
SSDEEP
24576:D1qiuGPkRxjps8E+1vQixH9sI5HUW3CM:D1qiuGPOjps1ivsi0W
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-