Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
QuotesRequestedComercialimg.img
-
Size
1.2MB
-
Sample
240111-y48xpsgfa8
-
MD5
6ceaa57090e943a2b7ecbe270ee19f50
-
SHA1
9a1d624548602bfd7789256f194b5501b1b68e79
-
SHA256
03dc84e14a6bce34170d367e55d43345b052857f83bcb39bafc07e51d9b4dd22
-
SHA512
12efe0121e302b3301d7b5dfa2b04af2ed7d0ef51a11b1886984795d71235bed18ef2858295c01c28bbd9089530d45744caef44d75179f15e8a0e781cb328de0
-
SSDEEP
12288:6UwoIc0vtdL/yVRtENyI8+wVXGlHy6eEHlbDq3Gaa746bGT:jwoIc0n/yVRUKlXGlHbHlbDq3Gaa7Vo
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
lnft kdkq zgnq njvv
Extracted
agenttesla
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
lnft kdkq zgnq njvv - Email To:
[email protected]
Targets
-
-
Target
Quote requested - COMERCIAL.exe
-
Size
680KB
-
MD5
955430b9ccede349ddb7a3c3c446df03
-
SHA1
bb79ab7b71ac3d76ace94e7fab21e54ef04e2a07
-
SHA256
5988dc31b375aee2bbe85b7e31900fca393da16bc2cdb9080d4592c31d30db60
-
SHA512
ba022a30653ae3dccb7f17d60722000f0817d41a4b907a14390863b40923c4040550a666afc7ee60e7b43065c29f8c2030b7d3e3f4fc7fb0cb34b2611cfaf091
-
SSDEEP
12288:pUwoIc0vtdL/yVRtENyI8+wVXGlHy6eEHlbDq3Gaa746bGT:qwoIc0n/yVRUKlXGlHbHlbDq3Gaa7Vo
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-