Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    QuotesRequestedComercialimg.img

  • Size

    1.2MB

  • Sample

    240111-y48xpsgfa8

  • MD5

    6ceaa57090e943a2b7ecbe270ee19f50

  • SHA1

    9a1d624548602bfd7789256f194b5501b1b68e79

  • SHA256

    03dc84e14a6bce34170d367e55d43345b052857f83bcb39bafc07e51d9b4dd22

  • SHA512

    12efe0121e302b3301d7b5dfa2b04af2ed7d0ef51a11b1886984795d71235bed18ef2858295c01c28bbd9089530d45744caef44d75179f15e8a0e781cb328de0

  • SSDEEP

    12288:6UwoIc0vtdL/yVRtENyI8+wVXGlHy6eEHlbDq3Gaa746bGT:jwoIc0n/yVRUKlXGlHbHlbDq3Gaa7Vo

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    lnft kdkq zgnq njvv

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Quote requested - COMERCIAL.exe

    • Size

      680KB

    • MD5

      955430b9ccede349ddb7a3c3c446df03

    • SHA1

      bb79ab7b71ac3d76ace94e7fab21e54ef04e2a07

    • SHA256

      5988dc31b375aee2bbe85b7e31900fca393da16bc2cdb9080d4592c31d30db60

    • SHA512

      ba022a30653ae3dccb7f17d60722000f0817d41a4b907a14390863b40923c4040550a666afc7ee60e7b43065c29f8c2030b7d3e3f4fc7fb0cb34b2611cfaf091

    • SSDEEP

      12288:pUwoIc0vtdL/yVRtENyI8+wVXGlHy6eEHlbDq3Gaa746bGT:qwoIc0n/yVRUKlXGlHbHlbDq3Gaa7Vo

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks