Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
0540fa5ba6c78d6001e586d360588bfd
-
Size
474KB
-
Sample
231229-13jbrsbdcl
-
MD5
0540fa5ba6c78d6001e586d360588bfd
-
SHA1
72a1d34b9eb3721b758bd9ea619877a061bd3783
-
SHA256
b7964a89e6a2241d174412de89aefa5cea84f723413cdfe5b2ad6aec40e7a54d
-
SHA512
38aee223015a55a5fe99af3dce002befffd78faed0bc1a3d35135e7675f7f0b2b850d09f4fbe29308a475c9858be45052cb07ca7381303159904cbd3ed5e9642
-
SSDEEP
12288:dfo25r7EhN5s6XgsMkllOCBJhs0tGwYLnbWtV/aEw2qR5jAuORm:dfo25r7EhN5s6X/xE0inOV/n585E/4
Static task
static1
Behavioral task
behavioral1
Sample
0540fa5ba6c78d6001e586d360588bfd.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0540fa5ba6c78d6001e586d360588bfd.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1734005980:AAERmgFyWDBh9hMP57ANBsWcWNSrihi2F_A/sendDocument
Targets
-
-
Target
0540fa5ba6c78d6001e586d360588bfd
-
Size
474KB
-
MD5
0540fa5ba6c78d6001e586d360588bfd
-
SHA1
72a1d34b9eb3721b758bd9ea619877a061bd3783
-
SHA256
b7964a89e6a2241d174412de89aefa5cea84f723413cdfe5b2ad6aec40e7a54d
-
SHA512
38aee223015a55a5fe99af3dce002befffd78faed0bc1a3d35135e7675f7f0b2b850d09f4fbe29308a475c9858be45052cb07ca7381303159904cbd3ed5e9642
-
SSDEEP
12288:dfo25r7EhN5s6XgsMkllOCBJhs0tGwYLnbWtV/aEw2qR5jAuORm:dfo25r7EhN5s6X/xE0inOV/n585E/4
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-