Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4fcbdbe09122e5dc33f831e7e65c39cab03b67e70e4d8f5d3c225a8c88c7fb7d.img

  • Size

    768KB

  • Sample

    240213-cvvg3aad3w

  • MD5

    44b5da05d2f080d09ec17359f60dacd6

  • SHA1

    f1e1e3c2caf7b233a98b6a2c0ac3eabb96f2081b

  • SHA256

    4fcbdbe09122e5dc33f831e7e65c39cab03b67e70e4d8f5d3c225a8c88c7fb7d

  • SHA512

    e5ce1cced3a9c4ae5c974e21e868d75d0296982cbd188d374f7a3df6ffe270ede0d5cd33e0529b1ecac41139ad82521b376c0983a9f1be3978d8f2c7188baa0a

  • SSDEEP

    12288:xCcj8EhT1GrAjbadQSIVCXfUWQBZoeAfeDlV25x3nGxYcBa8k:ocj8EzCdQSIkXsWQE4lV259Gx

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Ynstr.exe

    • Size

      718KB

    • MD5

      43a00ef10637139c060f1139df3b9cc1

    • SHA1

      f717df8434925d25e03512c91385bc528576339e

    • SHA256

      f2a3d321b3fbb2d3be23e5416a82b92d9aa73c3573ef0630d0570483ced8a731

    • SHA512

      19c9ea8f334c2ff21ae39339e94603f7245feb67784d22ab551c809d8d7dd364941b18c8e649476b9a260d89f8005ba9ebb5b9baf401327ef6c6a44c33602bbc

    • SSDEEP

      12288:RCcj8EhT1GrAjbadQSIVCXfUWQBZoeAfeDlV25x3nGxYcBa8k:Icj8EzCdQSIkXsWQE4lV259Gx

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Detect packed .NET executables. Mostly AgentTeslaV4.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables referencing Windows vault credential objects. Observed in infostealers

    • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

    • Detects executables referencing many email and collaboration clients. Observed in information stealers

    • Detects executables referencing many file transfer clients. Observed in information stealers

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks