Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

28d00d87d4...ae.exe

windows7-x64

10

28d00d87d4...ae.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    28d00d87d406268217ece94fd43872ae

  • Size

    886KB

  • Sample

    231231-ffmepafbgl

  • MD5

    28d00d87d406268217ece94fd43872ae

  • SHA1

    ba43a560933c6e39ff849a5912d864151649cb3f

  • SHA256

    a0f0f5f8d52668129652ae074bf54b936f038b3192bcb22d562d1542730b28ea

  • SHA512

    1c68a8f62cf9fee0810284d407ae5386642f156c6c620a5eb714d5e07a37ab9e91f0125977ef2a4bb719719e685bbefdcb9a6895e9c0c27f1a037d67a4274215

  • SSDEEP

    12288:ojkKpz/w/aYulS/XcmY28JHRsFD8+81KZcRA4meT0uAdU/AnZgoR6vgF0wS2u5XL:4h/w/JuqXcmcHaFD/ZdBeT0ofoR6vd

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.vivaldi.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    pmoneyboy994

Targets

    • Target

      28d00d87d406268217ece94fd43872ae

    • Size

      886KB

    • MD5

      28d00d87d406268217ece94fd43872ae

    • SHA1

      ba43a560933c6e39ff849a5912d864151649cb3f

    • SHA256

      a0f0f5f8d52668129652ae074bf54b936f038b3192bcb22d562d1542730b28ea

    • SHA512

      1c68a8f62cf9fee0810284d407ae5386642f156c6c620a5eb714d5e07a37ab9e91f0125977ef2a4bb719719e685bbefdcb9a6895e9c0c27f1a037d67a4274215

    • SSDEEP

      12288:ojkKpz/w/aYulS/XcmY28JHRsFD8+81KZcRA4meT0uAdU/AnZgoR6vgF0wS2u5XL:4h/w/JuqXcmcHaFD/ZdBeT0ofoR6vd

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks