Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f350ead728719718a5656299b43adbe4

  • Size

    648KB

  • Sample

    231222-t27veaghdj

  • MD5

    f350ead728719718a5656299b43adbe4

  • SHA1

    8ba8ed7a1e1ed7cd5ff2d5c7b225d16b5ab88128

  • SHA256

    a13818c085ae6a086b8020857d505758c9a4be67da60651ed90cbbd0aac2fd60

  • SHA512

    d847f81689ebf26a5027d43339da98ce8495cbb40ee3487efc95d2ece6ffc8582e7f44426aa658d68d3e16e84d93d5bec75db17cab22c6fdcd05e00e6c0f0cdf

  • SSDEEP

    12288:V53vR9uboUZLCYROqqBp87sVn+1PB9j7Ht9nR:V5Z92oU/UNiO+1PLtT

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://files.000webhost.com/
  • Port:
    21
  • Username:
    zinco
  • Password:
    computer147

Targets

    • Target

      f350ead728719718a5656299b43adbe4

    • Size

      648KB

    • MD5

      f350ead728719718a5656299b43adbe4

    • SHA1

      8ba8ed7a1e1ed7cd5ff2d5c7b225d16b5ab88128

    • SHA256

      a13818c085ae6a086b8020857d505758c9a4be67da60651ed90cbbd0aac2fd60

    • SHA512

      d847f81689ebf26a5027d43339da98ce8495cbb40ee3487efc95d2ece6ffc8582e7f44426aa658d68d3e16e84d93d5bec75db17cab22c6fdcd05e00e6c0f0cdf

    • SSDEEP

      12288:V53vR9uboUZLCYROqqBp87sVn+1PB9j7Ht9nR:V5Z92oU/UNiO+1PLtT

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks