Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
10c09bf68b04141d18e67eddaebb5230
-
Size
1.5MB
-
Sample
231224-y7e4ssbga2
-
MD5
10c09bf68b04141d18e67eddaebb5230
-
SHA1
5019f0603a35f3684d07f14db23b7ad21a5ead3e
-
SHA256
50090f602cc7b997c94b90564e6144b8680f5763cf7c736e55064cbc8dbfbea0
-
SHA512
39e9f11c66ab7002c00f1e50959df04759b5df64723344a914366b1f29502227ccd7f277eaff1204d63fb47484f0f316b033dfe6a7bc030a30e1c317f2a64ad5
-
SSDEEP
24576:kC76W5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+huv:D5iecIw0UIj2zHUCYNQuiNB/e
Static task
static1
Behavioral task
behavioral1
Sample
10c09bf68b04141d18e67eddaebb5230.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
10c09bf68b04141d18e67eddaebb5230.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.cosmolensky.com/ - Port:
21 - Username:
[email protected] - Password:
boygirl123456
Targets
-
-
Target
10c09bf68b04141d18e67eddaebb5230
-
Size
1.5MB
-
MD5
10c09bf68b04141d18e67eddaebb5230
-
SHA1
5019f0603a35f3684d07f14db23b7ad21a5ead3e
-
SHA256
50090f602cc7b997c94b90564e6144b8680f5763cf7c736e55064cbc8dbfbea0
-
SHA512
39e9f11c66ab7002c00f1e50959df04759b5df64723344a914366b1f29502227ccd7f277eaff1204d63fb47484f0f316b033dfe6a7bc030a30e1c317f2a64ad5
-
SSDEEP
24576:kC76W5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+huv:D5iecIw0UIj2zHUCYNQuiNB/e
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-