Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
f350ead728719718a5656299b43adbe4
-
Size
648KB
-
Sample
231222-t27veaghdj
-
MD5
f350ead728719718a5656299b43adbe4
-
SHA1
8ba8ed7a1e1ed7cd5ff2d5c7b225d16b5ab88128
-
SHA256
a13818c085ae6a086b8020857d505758c9a4be67da60651ed90cbbd0aac2fd60
-
SHA512
d847f81689ebf26a5027d43339da98ce8495cbb40ee3487efc95d2ece6ffc8582e7f44426aa658d68d3e16e84d93d5bec75db17cab22c6fdcd05e00e6c0f0cdf
-
SSDEEP
12288:V53vR9uboUZLCYROqqBp87sVn+1PB9j7Ht9nR:V5Z92oU/UNiO+1PLtT
Static task
static1
Behavioral task
behavioral1
Sample
f350ead728719718a5656299b43adbe4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f350ead728719718a5656299b43adbe4.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://files.000webhost.com/ - Port:
21 - Username:
zinco - Password:
computer147
Targets
-
-
Target
f350ead728719718a5656299b43adbe4
-
Size
648KB
-
MD5
f350ead728719718a5656299b43adbe4
-
SHA1
8ba8ed7a1e1ed7cd5ff2d5c7b225d16b5ab88128
-
SHA256
a13818c085ae6a086b8020857d505758c9a4be67da60651ed90cbbd0aac2fd60
-
SHA512
d847f81689ebf26a5027d43339da98ce8495cbb40ee3487efc95d2ece6ffc8582e7f44426aa658d68d3e16e84d93d5bec75db17cab22c6fdcd05e00e6c0f0cdf
-
SSDEEP
12288:V53vR9uboUZLCYROqqBp87sVn+1PB9j7Ht9nR:V5Z92oU/UNiO+1PLtT
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-