Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
b739916a350dbe762d16ff43b5e0b10ba8b334f9f6399d6bcec33a11cd5ce885
-
Size
644KB
-
Sample
240112-bs6lwacbbq
-
MD5
84eda553afa59a4d8c4a13957cfa4e24
-
SHA1
d73b0edf4d3a133c48695f8f39dc4c1532aba434
-
SHA256
b739916a350dbe762d16ff43b5e0b10ba8b334f9f6399d6bcec33a11cd5ce885
-
SHA512
9f890614b874db0e0aab5d1cc06a86c9dcd72b957943e6ad0afb2375affdd795e9de4afc441d5e5e88f3d5c7e375d3a546ae6904649b842990e8c91af76f19a5
-
SSDEEP
12288:wvbxyFpPkojTJKUI2CYwhiIgREza9QLUD+QJxv9NINj+w49Di:uopFsKhuhgOY9jxv9No+T9u
Static task
static1
Behavioral task
behavioral1
Sample
b739916a350dbe762d16ff43b5e0b10ba8b334f9f6399d6bcec33a11cd5ce885.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
b739916a350dbe762d16ff43b5e0b10ba8b334f9f6399d6bcec33a11cd5ce885.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
Protocol: smtp- Host:
cp5ua.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#
Extracted
agenttesla
Protocol: smtp- Host:
cp5ua.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@# - Email To:
[email protected]
Targets
-
-
Target
b739916a350dbe762d16ff43b5e0b10ba8b334f9f6399d6bcec33a11cd5ce885
-
Size
644KB
-
MD5
84eda553afa59a4d8c4a13957cfa4e24
-
SHA1
d73b0edf4d3a133c48695f8f39dc4c1532aba434
-
SHA256
b739916a350dbe762d16ff43b5e0b10ba8b334f9f6399d6bcec33a11cd5ce885
-
SHA512
9f890614b874db0e0aab5d1cc06a86c9dcd72b957943e6ad0afb2375affdd795e9de4afc441d5e5e88f3d5c7e375d3a546ae6904649b842990e8c91af76f19a5
-
SSDEEP
12288:wvbxyFpPkojTJKUI2CYwhiIgREza9QLUD+QJxv9NINj+w49Di:uopFsKhuhgOY9jxv9No+T9u
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-