Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

1a048f609f...59.exe

windows7-x64

10

1a048f609f...59.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1a048f609f3a7418874831c8a6ffe57086859989bede8015e3feb62a790fc659

  • Size

    696KB

  • Sample

    240306-ct7e8sge8t

  • MD5

    83d3695bbde9ea650aa70395ca83aa05

  • SHA1

    85a9747cb5acdc8baf3a64a358b561e74e001d08

  • SHA256

    1a048f609f3a7418874831c8a6ffe57086859989bede8015e3feb62a790fc659

  • SHA512

    be2bc7e7d036d59c1126694ede3ae03d197f2071a2a0a838cc3183833e229f0811cb0c041cad759a1c6909da28fc3c4c0527eb946a38552383c520b9a10e70d4

  • SSDEEP

    12288:9A6LpfRvMF03e7xtdkosCfKjAXXJNIxPJTDw9vWau2iN:bLjMQQzsCfrX5New4au1

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      1a048f609f3a7418874831c8a6ffe57086859989bede8015e3feb62a790fc659

    • Size

      696KB

    • MD5

      83d3695bbde9ea650aa70395ca83aa05

    • SHA1

      85a9747cb5acdc8baf3a64a358b561e74e001d08

    • SHA256

      1a048f609f3a7418874831c8a6ffe57086859989bede8015e3feb62a790fc659

    • SHA512

      be2bc7e7d036d59c1126694ede3ae03d197f2071a2a0a838cc3183833e229f0811cb0c041cad759a1c6909da28fc3c4c0527eb946a38552383c520b9a10e70d4

    • SSDEEP

      12288:9A6LpfRvMF03e7xtdkosCfKjAXXJNIxPJTDw9vWau2iN:bLjMQQzsCfrX5New4au1

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks