Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
95342d530759c64eeace810c555ee4f933f42e974e32be929a9d36e13da5e050
-
Size
859KB
-
Sample
231211-dew7dscdh7
-
MD5
da09fd188e1fd951bc127dfa400fd4a2
-
SHA1
482b00a6a101c6215b7de9a2650f6a94163ac26f
-
SHA256
95342d530759c64eeace810c555ee4f933f42e974e32be929a9d36e13da5e050
-
SHA512
36fb1406c0a0c2560dfd4596c2119e3fba1fa4bf845cf391cd6734703153315231202c834b555c3a5b5870f60d3afefffca616ff7721df95cfd4f1a4c7d09c0b
-
SSDEEP
24576:6PMg98ScI7izkL+XL9SidnF4IfeHAOPw4Me76Hco:yMXScIHiF4IWHAOPw4MMo
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1183395967563747379/uiR-L8sCPAbmIk762kRjA9KmM-l1_wr48uBrF5rgQJmviD0L7w1EJt85eDdGByNRZnXH
Targets
-
-
Target
RFQ#445890_INQDEC2895PROD_Hangzhou Zhongniu_Import_Export Co.exe
-
Size
923KB
-
MD5
25277cf15e643825284c3c6c954bf9d8
-
SHA1
9d52fb5e99e709a3d318743becfefc33d9317016
-
SHA256
7d3491f8d6165d53723b95e8b794bf457cae9866aa5acee96d380593573c1978
-
SHA512
18f873744a0568a91f7f4c1a4a18d6014df03726d166acb90098235d7b68ea6db3d9953ef815b42fd7cfe23de71b779b3bf1078584ca759afa1ab9a5c91e94ee
-
SSDEEP
24576:BNIMPAg98Gwi7iBcTW7L9Cidfv4ifeHkOPwaMe7YHehW:vxAXGwiRmH4iWHkOPwaMOU
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-