Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Balance payment.zip
-
Size
596KB
-
Sample
231212-qlnvtafbd8
-
MD5
be366a7ada868f3869a977b902224fed
-
SHA1
1e11dbd212c8ac695d3d945be9edbcfe2bdfac53
-
SHA256
2caebef8945d20deddcf6977b0091781dc91f78c52169c066ab87906bcbd3968
-
SHA512
fe0da7a05ad261ecc24eab54e4076e97d772061a6b975e1292e7d83b75463c8feb07698f8e668c6b3c2666cab68e184249b65edd9f09f9918004c660d5e3aab7
-
SSDEEP
12288:RvB0QwWDObNTB2KxR57IhP2bXoJeiBAmTbIafWX4XtHi:RvB0QryTUoRIsbXopHxfWXWC
Static task
static1
Behavioral task
behavioral1
Sample
Balance payment.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
Balance payment.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.vrlogistic.com - Port:
587 - Username:
[email protected] - Password:
@dmin@123 - Email To:
[email protected]
Targets
-
-
Target
Balance payment.exe
-
Size
614KB
-
MD5
c76751eb111c227d587f5aff012df2fc
-
SHA1
89069a18e42fc15da8d221893dbadef9715ce5c8
-
SHA256
3f479de77fd65ff82d89c44b941aedd81d9afe93093699e40ba82b02e058719a
-
SHA512
39b7642c99bace5f1a1577a58cdb702fb384dbabeff28e9044a373b4f1e4c8a05e672c52e4ac21d16503afec5ec2f6656506a73901d8233c620f3110be6d827e
-
SSDEEP
12288:z3IU8S6eUdSTThn7IDPAbXopeOBA2TiE20XpMaqzIH+YOL:DItSAduhI0bXoVwEIamDH
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-