Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
740e3dd23ebbc1ba1ecd5c728d598b1a40e7683d67d96e72e6102a4bd1a04e91
-
Size
598KB
-
Sample
240203-b5mpjaead4
-
MD5
ff1311f93f8239ad871aa5277d396703
-
SHA1
25a1283b145440b5b6a3b982dae29c646b3dad95
-
SHA256
740e3dd23ebbc1ba1ecd5c728d598b1a40e7683d67d96e72e6102a4bd1a04e91
-
SHA512
ebb815bb0aba49c524ce906d33e29dc17795619b10c378a6715e48ac6c06a3933c49ac107c6ad79cad1e58b5681cbb67179d6c11e379f5d5bac269fa87f4ec33
-
SSDEEP
12288:weW/T7I3AA/98qzGTfQLFRPzci/9iMH+hc7VGmR7WQIA:Hi7up8rcLvPPoMHdxvF
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.expertsconsultgh.co - Port:
587 - Username:
[email protected] - Password:
Oppong.2012 - Email To:
[email protected]
Targets
-
-
Target
740e3dd23ebbc1ba1ecd5c728d598b1a40e7683d67d96e72e6102a4bd1a04e91
-
Size
598KB
-
MD5
ff1311f93f8239ad871aa5277d396703
-
SHA1
25a1283b145440b5b6a3b982dae29c646b3dad95
-
SHA256
740e3dd23ebbc1ba1ecd5c728d598b1a40e7683d67d96e72e6102a4bd1a04e91
-
SHA512
ebb815bb0aba49c524ce906d33e29dc17795619b10c378a6715e48ac6c06a3933c49ac107c6ad79cad1e58b5681cbb67179d6c11e379f5d5bac269fa87f4ec33
-
SSDEEP
12288:weW/T7I3AA/98qzGTfQLFRPzci/9iMH+hc7VGmR7WQIA:Hi7up8rcLvPPoMHdxvF
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-