Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9
-
Size
35KB
-
Sample
240212-bj59raec3z
-
MD5
e13f118e244caa9f239a6d6eaed6f56b
-
SHA1
35389ff25b75d439c83e540a023b15c6b92f1b8e
-
SHA256
69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9
-
SHA512
2218d8c266bb4a72964f8f65be9a79a2aee915df9e4716eebd67107d6ac8973749aba16acd76991ca0f4c7d739a7e7176c8325b929909ad57b4811ab0caa6188
-
SSDEEP
384:vMLwC6zvkHvrdvgJ/hcK8L3N6f5DXor78s/nqcF1uLfssuUIA+/doayii1l+M7si:0LwXzv2J2F5LUsTIbmapOl+M7rhQy
Static task
static1
Behavioral task
behavioral1
Sample
69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9.exe
Resource
win10v2004-20231222-en
Malware Config
Extracted
Protocol: smtp- Host:
bulktz.com.ng - Port:
587 - Username:
[email protected] - Password:
Babablue2024$
Extracted
agenttesla
Protocol: smtp- Host:
bulktz.com.ng - Port:
587 - Username:
[email protected] - Password:
Babablue2024$ - Email To:
[email protected]
Targets
-
-
Target
69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9
-
Size
35KB
-
MD5
e13f118e244caa9f239a6d6eaed6f56b
-
SHA1
35389ff25b75d439c83e540a023b15c6b92f1b8e
-
SHA256
69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9
-
SHA512
2218d8c266bb4a72964f8f65be9a79a2aee915df9e4716eebd67107d6ac8973749aba16acd76991ca0f4c7d739a7e7176c8325b929909ad57b4811ab0caa6188
-
SSDEEP
384:vMLwC6zvkHvrdvgJ/hcK8L3N6f5DXor78s/nqcF1uLfssuUIA+/doayii1l+M7si:0LwXzv2J2F5LUsTIbmapOl+M7rhQy
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-