Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
b77a822b8d6011db096cfc1c77093658abfed4c7ae160d8c31c8534405eacb43
-
Size
870KB
-
Sample
240306-chfhdaga6v
-
MD5
de7aa76fae7c8c9c291e38b63a4969e7
-
SHA1
b9eac7a45209cff192d88b514359f9f6527b6108
-
SHA256
b77a822b8d6011db096cfc1c77093658abfed4c7ae160d8c31c8534405eacb43
-
SHA512
e08291061b2297a5320efcf56c4a3c8c4a4a68a747e04f475d8662cb3bc5d92a2b377547666a9924af0fed2d705e55566c53198c379390e7556a37279b2baa1e
-
SSDEEP
12288:0DdCjlqQj5jG3ylTBkml8M6M+DVx0I550wWTbNQvSbL2:BEejtPhKEI70LbuAL2
Static task
static1
Behavioral task
behavioral1
Sample
b77a822b8d6011db096cfc1c77093658abfed4c7ae160d8c31c8534405eacb43.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b77a822b8d6011db096cfc1c77093658abfed4c7ae160d8c31c8534405eacb43.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.guestequipment.com.au - Port:
587 - Username:
[email protected] - Password:
Clone89! - Email To:
[email protected]
Targets
-
-
Target
b77a822b8d6011db096cfc1c77093658abfed4c7ae160d8c31c8534405eacb43
-
Size
870KB
-
MD5
de7aa76fae7c8c9c291e38b63a4969e7
-
SHA1
b9eac7a45209cff192d88b514359f9f6527b6108
-
SHA256
b77a822b8d6011db096cfc1c77093658abfed4c7ae160d8c31c8534405eacb43
-
SHA512
e08291061b2297a5320efcf56c4a3c8c4a4a68a747e04f475d8662cb3bc5d92a2b377547666a9924af0fed2d705e55566c53198c379390e7556a37279b2baa1e
-
SSDEEP
12288:0DdCjlqQj5jG3ylTBkml8M6M+DVx0I550wWTbNQvSbL2:BEejtPhKEI70LbuAL2
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-