Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

2c26f0b183...0f.exe

windows7-x64

10

2c26f0b183...0f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c26f0b1833d33b6b3091885bc22496e3430f94c72a1b879d5506c5162336c0f

  • Size

    1.1MB

  • Sample

    240129-bfebvsgafq

  • MD5

    0da9c8bde3c04ee8473e019013052be6

  • SHA1

    67bb42dc74b06553130169dbbacca48b0b0f3aaa

  • SHA256

    2c26f0b1833d33b6b3091885bc22496e3430f94c72a1b879d5506c5162336c0f

  • SHA512

    9b7f6650a4acc2ea5178876613def924aba3e05974706b5370d4d5cbf805191266bbc38026232925ac495bb375f56dbb4cade28bc4d960690cea767c9ba81861

  • SSDEEP

    24576:TAHnh+eWsN3skA4RV1Hom2KXMmHabCQLVLVAEMvQOA5:eh+ZkldoPK8YabbVL+4

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      2c26f0b1833d33b6b3091885bc22496e3430f94c72a1b879d5506c5162336c0f

    • Size

      1.1MB

    • MD5

      0da9c8bde3c04ee8473e019013052be6

    • SHA1

      67bb42dc74b06553130169dbbacca48b0b0f3aaa

    • SHA256

      2c26f0b1833d33b6b3091885bc22496e3430f94c72a1b879d5506c5162336c0f

    • SHA512

      9b7f6650a4acc2ea5178876613def924aba3e05974706b5370d4d5cbf805191266bbc38026232925ac495bb375f56dbb4cade28bc4d960690cea767c9ba81861

    • SSDEEP

      24576:TAHnh+eWsN3skA4RV1Hom2KXMmHabCQLVLVAEMvQOA5:eh+ZkldoPK8YabbVL+4

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks