Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    55babb580500c46717c9b5798e6c098bb6e6decc37a8c9b38dd0164cfb50e6a0

  • Size

    224KB

  • Sample

    240223-bdqbcahb4s

  • MD5

    f6c09cd9a367fbf59f50c41e6c0cd290

  • SHA1

    0aa28edc6eddce4decda784798968a835fb4f6f9

  • SHA256

    55babb580500c46717c9b5798e6c098bb6e6decc37a8c9b38dd0164cfb50e6a0

  • SHA512

    4b29b6cdada1167e567080abf53668a207449562a76fc5acc8c41e57911e2e3e4b42fb782e06039295edf7a65b51974b8ae239c6ebc9913665b9e5b38fedb66d

  • SSDEEP

    6144:oKaDj9fYeH6xzMiriMTr1Us7nRWHTZw/re1TiXwbZ8:EpAeH6xzMiriMTr1U4nQzZw/STU

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6981023497:AAHl8hNT6c3ywQtrLSswit8gBAF4M9xCAZU/

Targets

    • Target

      55babb580500c46717c9b5798e6c098bb6e6decc37a8c9b38dd0164cfb50e6a0

    • Size

      224KB

    • MD5

      f6c09cd9a367fbf59f50c41e6c0cd290

    • SHA1

      0aa28edc6eddce4decda784798968a835fb4f6f9

    • SHA256

      55babb580500c46717c9b5798e6c098bb6e6decc37a8c9b38dd0164cfb50e6a0

    • SHA512

      4b29b6cdada1167e567080abf53668a207449562a76fc5acc8c41e57911e2e3e4b42fb782e06039295edf7a65b51974b8ae239c6ebc9913665b9e5b38fedb66d

    • SSDEEP

      6144:oKaDj9fYeH6xzMiriMTr1Us7nRWHTZw/re1TiXwbZ8:EpAeH6xzMiriMTr1U4nQzZw/STU

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks