Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
c527ff1b18581fbd4e2813b51b414b5ffdee8c49ead1476ea0ed9a1dfacc6659
-
Size
668KB
-
Sample
240201-bvntvaacfk
-
MD5
1bb1095059a6f5f01895f3c6c906a50a
-
SHA1
cb60951acc0a0e09db96729e644ca4bda586992e
-
SHA256
c527ff1b18581fbd4e2813b51b414b5ffdee8c49ead1476ea0ed9a1dfacc6659
-
SHA512
45981b12bfbfcb69465ece150da300eec6454e0468d3eb7daebbc8171376f576f8278533f870b458d9a2406b9335b91ca3dfde9a777c8f4de099300d6a7bcf0c
-
SSDEEP
12288:IAN8j8qshDs5E6xMSM5/SD5iT5YsuEGMVhbDu6ROybSS0qAn/62:FN8bshIiCDQT51uErRDucHSS0RT
Static task
static1
Behavioral task
behavioral1
Sample
c527ff1b18581fbd4e2813b51b414b5ffdee8c49ead1476ea0ed9a1dfacc6659.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c527ff1b18581fbd4e2813b51b414b5ffdee8c49ead1476ea0ed9a1dfacc6659.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.rimiapparelsltd.com - Port:
587 - Username:
[email protected] - Password:
Everest10@ - Email To:
[email protected]
Targets
-
-
Target
c527ff1b18581fbd4e2813b51b414b5ffdee8c49ead1476ea0ed9a1dfacc6659
-
Size
668KB
-
MD5
1bb1095059a6f5f01895f3c6c906a50a
-
SHA1
cb60951acc0a0e09db96729e644ca4bda586992e
-
SHA256
c527ff1b18581fbd4e2813b51b414b5ffdee8c49ead1476ea0ed9a1dfacc6659
-
SHA512
45981b12bfbfcb69465ece150da300eec6454e0468d3eb7daebbc8171376f576f8278533f870b458d9a2406b9335b91ca3dfde9a777c8f4de099300d6a7bcf0c
-
SSDEEP
12288:IAN8j8qshDs5E6xMSM5/SD5iT5YsuEGMVhbDu6ROybSS0qAn/62:FN8bshIiCDQT51uErRDucHSS0RT
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-