Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Dokument Zamówienie ZZ2200439_pdf .exe

  • Size

    64KB

  • Sample

    240112-nf3exafff2

  • MD5

    19456c568f32de851c7cc7416ee24f6d

  • SHA1

    302e970eb88d10c50416cfb3ca97c38af43d6c72

  • SHA256

    a1e1569dfcaedc7962d5af6fcb5b022b5faddeef372cd7458fd3f383e0dcd560

  • SHA512

    b375173ff4580c3291eec9c008149ee2c02bb56b416b1a645f27d6e2cdf67a5578466a75718f8caba696c4019d8560ae2a4ddff608323e3c98bf82043dc8a13a

  • SSDEEP

    384:KbtRPNVHT535J7P1DXsq0EosoEt2foH+qtJAz0WY/OjITPkG0O1q3+MJvbDlViWG:KbtBzDJzJ8q0EosoEkgk7uH0cMJvbI

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Dokument Zamówienie ZZ2200439_pdf .exe

    • Size

      64KB

    • MD5

      19456c568f32de851c7cc7416ee24f6d

    • SHA1

      302e970eb88d10c50416cfb3ca97c38af43d6c72

    • SHA256

      a1e1569dfcaedc7962d5af6fcb5b022b5faddeef372cd7458fd3f383e0dcd560

    • SHA512

      b375173ff4580c3291eec9c008149ee2c02bb56b416b1a645f27d6e2cdf67a5578466a75718f8caba696c4019d8560ae2a4ddff608323e3c98bf82043dc8a13a

    • SSDEEP

      384:KbtRPNVHT535J7P1DXsq0EosoEt2foH+qtJAz0WY/OjITPkG0O1q3+MJvbDlViWG:KbtBzDJzJ8q0EosoEkgk7uH0cMJvbI

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks