Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Christmas Tree and Wishes.img
-
Size
1.4MB
-
Sample
231226-jw3cmaegcj
-
MD5
2edd84608b18b2098b09398d276e05a2
-
SHA1
8f951156c366ed42dcc7ba8af1e8b4b529c95fe6
-
SHA256
7bf1401269b1ed13ad18c65c45c6f54d6844a14e311053493eb94f0893ec739f
-
SHA512
a9f98a0011b802c896c357319f1d6bdab1f2f64cf76d7aa02bc51c5221f0b34a7429ec91771e49b8f01f11796adbfcab7f43afd56d72f8854f5d88bde8506569
-
SSDEEP
12288:VU6NIHXUVUzXNrQtNMp8tP5S/kVtjNBu2EkS9ZA8+VcTxQ+4mxUvvwqhMwGqte20:ihuMitPIs3ruOSQ8fXL+vTewGqMM72X
Static task
static1
Behavioral task
behavioral1
Sample
Christmas Tree and Wishes.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Christmas Tree and Wishes.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.aranybarany.hu - Port:
587 - Username:
[email protected] - Password:
18Szalloda94 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.aranybarany.hu - Port:
587 - Username:
[email protected] - Password:
18Szalloda94
Targets
-
-
Target
Christmas Tree and Wishes.exe
-
Size
928KB
-
MD5
87231278871e75634a5908e997d3d206
-
SHA1
a5bfe2f65efc3cf19db69727d9e5b3227cd0d9b5
-
SHA256
57653821b3827abd3779dcfc3a2d03f480eccf8beab8bc541ecda5aa9dc1bdcc
-
SHA512
53d0fd37d0f82e1281442157f89362678e265781ab3f34076246655e6d6e423d384a3958d6ceccc8eb73199761206f15000747ed4c3c5ce2d6ec8408313f3fd8
-
SSDEEP
12288:/U6NIHXUVUzXNrQtNMp8tP5S/kVtjNBu2EkS9ZA8+VcTxQ+4mxUvvwqhMwGqte20:YhuMitPIs3ruOSQ8fXL+vTewGqMM72X
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-