Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

b77a822b8d...43.exe

windows7-x64

10

b77a822b8d...43.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b77a822b8d6011db096cfc1c77093658abfed4c7ae160d8c31c8534405eacb43

  • Size

    870KB

  • Sample

    240306-chfhdaga6v

  • MD5

    de7aa76fae7c8c9c291e38b63a4969e7

  • SHA1

    b9eac7a45209cff192d88b514359f9f6527b6108

  • SHA256

    b77a822b8d6011db096cfc1c77093658abfed4c7ae160d8c31c8534405eacb43

  • SHA512

    e08291061b2297a5320efcf56c4a3c8c4a4a68a747e04f475d8662cb3bc5d92a2b377547666a9924af0fed2d705e55566c53198c379390e7556a37279b2baa1e

  • SSDEEP

    12288:0DdCjlqQj5jG3ylTBkml8M6M+DVx0I550wWTbNQvSbL2:BEejtPhKEI70LbuAL2

Score
10/10
agentteslakeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      b77a822b8d6011db096cfc1c77093658abfed4c7ae160d8c31c8534405eacb43

    • Size

      870KB

    • MD5

      de7aa76fae7c8c9c291e38b63a4969e7

    • SHA1

      b9eac7a45209cff192d88b514359f9f6527b6108

    • SHA256

      b77a822b8d6011db096cfc1c77093658abfed4c7ae160d8c31c8534405eacb43

    • SHA512

      e08291061b2297a5320efcf56c4a3c8c4a4a68a747e04f475d8662cb3bc5d92a2b377547666a9924af0fed2d705e55566c53198c379390e7556a37279b2baa1e

    • SSDEEP

      12288:0DdCjlqQj5jG3ylTBkml8M6M+DVx0I550wWTbNQvSbL2:BEejtPhKEI70LbuAL2

    Score
    10/10
    agentteslakeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks