Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Pago Transferencias 897877667.exe

  • Size

    812KB

  • Sample

    240307-svrdeafe7t

  • MD5

    fb8b15d6bd446628322c1b99b8fa8fd6

  • SHA1

    d78c815199c63a24d0b290ed4ef641ea2a301a94

  • SHA256

    4e9b3f914eaa619fc41ec582d09594b67cf581d38d8c0d4ff911b2d2d37f7846

  • SHA512

    8cb436beced7910dc2d82687d413389b450a22ed6fd731752852cb6e313161189130524190b310acf447a1799ac1580e35cf6552c8b27c899dee21df97f9be9f

  • SSDEEP

    12288:mgOiqjF+Wf8BHOLjv6T+lPs9szHc0DcBqQvzorzKfbV6pBp5unRO:mgYF+xVP4U9sbmXorCV6rp5uRO

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Pago Transferencias 897877667.exe

    • Size

      812KB

    • MD5

      fb8b15d6bd446628322c1b99b8fa8fd6

    • SHA1

      d78c815199c63a24d0b290ed4ef641ea2a301a94

    • SHA256

      4e9b3f914eaa619fc41ec582d09594b67cf581d38d8c0d4ff911b2d2d37f7846

    • SHA512

      8cb436beced7910dc2d82687d413389b450a22ed6fd731752852cb6e313161189130524190b310acf447a1799ac1580e35cf6552c8b27c899dee21df97f9be9f

    • SSDEEP

      12288:mgOiqjF+Wf8BHOLjv6T+lPs9szHc0DcBqQvzorzKfbV6pBp5unRO:mgYF+xVP4U9sbmXorCV6rp5uRO

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks