Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    859ab25dd3293afd3340bcf184ffde56

  • Size

    1.3MB

  • Sample

    240201-b6m2pagfg3

  • MD5

    859ab25dd3293afd3340bcf184ffde56

  • SHA1

    bafb31af0c29dbfd048e99220c59e7d133c45aec

  • SHA256

    c9f4f657e5c919e79eb5eaae5b0ac38683497288f7671f843d5097bf8fe96bf4

  • SHA512

    882324787b8662f66de3d06ff5fbc53f216ef89dc81c4b0e9006fe0107050cc11b599fa4db1d45a4072741cb3032bc33e982166e32f7ce6a189afbac5340adaa

  • SSDEEP

    24576:NU6nWI0raIi1Vfch/9K/4PMavESaoWV/Nm/y12NhmSO:NUTIKaV1Vfm82MavzVyYY

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.carryfastagencies.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    jim$7257

Targets

    • Target

      859ab25dd3293afd3340bcf184ffde56

    • Size

      1.3MB

    • MD5

      859ab25dd3293afd3340bcf184ffde56

    • SHA1

      bafb31af0c29dbfd048e99220c59e7d133c45aec

    • SHA256

      c9f4f657e5c919e79eb5eaae5b0ac38683497288f7671f843d5097bf8fe96bf4

    • SHA512

      882324787b8662f66de3d06ff5fbc53f216ef89dc81c4b0e9006fe0107050cc11b599fa4db1d45a4072741cb3032bc33e982166e32f7ce6a189afbac5340adaa

    • SSDEEP

      24576:NU6nWI0raIi1Vfch/9K/4PMavESaoWV/Nm/y12NhmSO:NUTIKaV1Vfm82MavzVyYY

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks