Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ZiraatEkstre_202402.exe

  • Size

    741KB

  • Sample

    240306-q4nmrscc6y

  • MD5

    8eb8223bb9aaee82947706824da95d3b

  • SHA1

    6ad6dcad0d6955ab1cc310a1ec11dceecadef3a2

  • SHA256

    c2d0cc385181b9e1685ce28e76d5bd1865843e67eb97796a6529bfaa34774816

  • SHA512

    010511b689a19d923141a2cf53a17b707ee327a66e302b571bc5d7df2ca48e25c5ab09dc1d4f178f0ecf77fa4813c46239f6e353d50534842d70acb40bae49a9

  • SSDEEP

    12288:66FO1lsajo9/j789tmEPGxIsXHjNuBT7fKaqL5qaxzgAyqoDvF5jAXmHzUKkR:nf/jEmEPGBXxgT7twVx/oDvnzUJ

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    zqamcx.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Methodman991

Targets

    • Target

      ZiraatEkstre_202402.exe

    • Size

      741KB

    • MD5

      8eb8223bb9aaee82947706824da95d3b

    • SHA1

      6ad6dcad0d6955ab1cc310a1ec11dceecadef3a2

    • SHA256

      c2d0cc385181b9e1685ce28e76d5bd1865843e67eb97796a6529bfaa34774816

    • SHA512

      010511b689a19d923141a2cf53a17b707ee327a66e302b571bc5d7df2ca48e25c5ab09dc1d4f178f0ecf77fa4813c46239f6e353d50534842d70acb40bae49a9

    • SSDEEP

      12288:66FO1lsajo9/j789tmEPGxIsXHjNuBT7fKaqL5qaxzgAyqoDvF5jAXmHzUKkR:nf/jEmEPGBXxgT7twVx/oDvnzUJ

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks