Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
edc548d0cb336bfa46b4c11d75dbf8ef444c0272a69ef8911f017d8ba1bd386d
-
Size
702KB
-
Sample
231126-b8wfvaeb85
-
MD5
c6f9deba104844b38291fe0f4d0cf437
-
SHA1
098ea69b71f532aafcde042665dc0949a943726b
-
SHA256
edc548d0cb336bfa46b4c11d75dbf8ef444c0272a69ef8911f017d8ba1bd386d
-
SHA512
8f6930aef2ec04c7dba7bee42ea67c071e4004e96881fcd1bfcaaae15a29386031e1a3340738dd32c6f7b42bd415606fec077c87b97b06d1b37ed6b831ae3732
-
SSDEEP
12288:8W361h61EWGVGtvTWS7sDDwh2r6KpAH9eFU6I/wHCX98vT4O6yWR3EAmD:8bY7GVCpewK6ikMmZHgTuBd
Static task
static1
Behavioral task
behavioral1
Sample
edc548d0cb336bfa46b4c11d75dbf8ef444c0272a69ef8911f017d8ba1bd386d.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
edc548d0cb336bfa46b4c11d75dbf8ef444c0272a69ef8911f017d8ba1bd386d.exe
Resource
win10v2004-20231023-en
Malware Config
Extracted
Protocol: smtp- Host:
mail.hkdreamcan.com - Port:
587 - Username:
[email protected] - Password:
HKdreamcan.2021
Extracted
agenttesla
Protocol: smtp- Host:
mail.hkdreamcan.com - Port:
587 - Username:
[email protected] - Password:
HKdreamcan.2021 - Email To:
[email protected]
Targets
-
-
Target
edc548d0cb336bfa46b4c11d75dbf8ef444c0272a69ef8911f017d8ba1bd386d
-
Size
702KB
-
MD5
c6f9deba104844b38291fe0f4d0cf437
-
SHA1
098ea69b71f532aafcde042665dc0949a943726b
-
SHA256
edc548d0cb336bfa46b4c11d75dbf8ef444c0272a69ef8911f017d8ba1bd386d
-
SHA512
8f6930aef2ec04c7dba7bee42ea67c071e4004e96881fcd1bfcaaae15a29386031e1a3340738dd32c6f7b42bd415606fec077c87b97b06d1b37ed6b831ae3732
-
SSDEEP
12288:8W361h61EWGVGtvTWS7sDDwh2r6KpAH9eFU6I/wHCX98vT4O6yWR3EAmD:8bY7GVCpewK6ikMmZHgTuBd
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-