Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
37ef0d25d599bc8314e904d3b7d0ad26
-
Size
510KB
-
Sample
231231-qn96tsbbhq
-
MD5
37ef0d25d599bc8314e904d3b7d0ad26
-
SHA1
6c8fd89cb1082c5d2688a5eff9279558d558ab52
-
SHA256
f0f4aecb098f92a033355c2058300583967a7fbf00c81ce2f3ba250b8ae3e277
-
SHA512
15362d1c2f02f9bd923d4d91447d46de33f4b5ed0574c1524afd754ecf3b0917e259de4cc008df519e56aed2a2c4c1635ab1c8ed45f23bcfa37905cfe73df481
-
SSDEEP
12288:Xwq0XK1hApxvbKH+jSgTY9MRIHACrADR7+U1+owChKh6V:H71hAjKH+jSSYSRIHdW
Static task
static1
Behavioral task
behavioral1
Sample
37ef0d25d599bc8314e904d3b7d0ad26.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
37ef0d25d599bc8314e904d3b7d0ad26.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.fclbd.com - Port:
587 - Username:
[email protected] - Password:
abc@123@ - Email To:
[email protected]
Targets
-
-
Target
37ef0d25d599bc8314e904d3b7d0ad26
-
Size
510KB
-
MD5
37ef0d25d599bc8314e904d3b7d0ad26
-
SHA1
6c8fd89cb1082c5d2688a5eff9279558d558ab52
-
SHA256
f0f4aecb098f92a033355c2058300583967a7fbf00c81ce2f3ba250b8ae3e277
-
SHA512
15362d1c2f02f9bd923d4d91447d46de33f4b5ed0574c1524afd754ecf3b0917e259de4cc008df519e56aed2a2c4c1635ab1c8ed45f23bcfa37905cfe73df481
-
SSDEEP
12288:Xwq0XK1hApxvbKH+jSgTY9MRIHACrADR7+U1+owChKh6V:H71hAjKH+jSSYSRIHdW
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-