Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
326068aa434690c190e1784ac4eef5198e550e41b7189738879ed042ed97e732.exe
-
Size
711KB
-
Sample
240222-ggbj9adc57
-
MD5
672ff72e4c953163d29662a9e349a2b2
-
SHA1
ed30eff3a33dba1831aa311329574e3a7987ea15
-
SHA256
326068aa434690c190e1784ac4eef5198e550e41b7189738879ed042ed97e732
-
SHA512
18558af027a861839cb32a3d1a4df6fca196f2cd2598d48e3b48235e90d434511bf3d9393fbd00ded8e6fce83826dab70ff89006bba59d6fc3758e032d8f11bb
-
SSDEEP
12288:SOg3KLpQOSpMVy1yuSLK8MRFKT/9tlxeJSUFYCmf0WJHtnQ0R0MuC2iN:jwKLpQO6MAInY8BxeJnFY+2ZOMuC1
Malware Config
Extracted
Protocol: smtp- Host:
box.flytach-tw.com - Port:
587 - Username:
[email protected] - Password:
Daddyhandsome@1234
Extracted
agenttesla
Protocol: smtp- Host:
box.flytach-tw.com - Port:
587 - Username:
[email protected] - Password:
Daddyhandsome@1234 - Email To:
[email protected]
Targets
-
-
Target
326068aa434690c190e1784ac4eef5198e550e41b7189738879ed042ed97e732.exe
-
Size
711KB
-
MD5
672ff72e4c953163d29662a9e349a2b2
-
SHA1
ed30eff3a33dba1831aa311329574e3a7987ea15
-
SHA256
326068aa434690c190e1784ac4eef5198e550e41b7189738879ed042ed97e732
-
SHA512
18558af027a861839cb32a3d1a4df6fca196f2cd2598d48e3b48235e90d434511bf3d9393fbd00ded8e6fce83826dab70ff89006bba59d6fc3758e032d8f11bb
-
SSDEEP
12288:SOg3KLpQOSpMVy1yuSLK8MRFKT/9tlxeJSUFYCmf0WJHtnQ0R0MuC2iN:jwKLpQO6MAInY8BxeJnFY+2ZOMuC1
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects executables referencing Windows vault credential objects. Observed in infostealers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
-
Detects executables referencing many email and collaboration clients. Observed in information stealers
-
Detects executables referencing many file transfer clients. Observed in information stealers
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-