Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    8d5cd706b6f9be925bf64e63eff0db9c3205788d635f7fc31488315b74192352

  • Size

    616KB

  • Sample

    240314-b5t4lsfe5t

  • MD5

    7a89a9e624efe2d98f3377def94cf549

  • SHA1

    980b1d129361886ace0efae85c01e7fed01930d5

  • SHA256

    8d5cd706b6f9be925bf64e63eff0db9c3205788d635f7fc31488315b74192352

  • SHA512

    78ccd6003e812532387edf6d147749a5e89380d98b84b391342b70b3805fc4fb5f4758c54c3f2054c20e500fe7ce8b8192568d919f0cffa1dff735ba7a7d319e

  • SSDEEP

    12288:Q2HYkxswcXKC2zNWfm2YRm5sm2YRm5hkxswcXKC2zNW:BHYZX9uWfm2Yysm2YyhZX9uW

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.ozmetalsan.com.tr
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ikircicek4521

Targets

    • Target

      8d5cd706b6f9be925bf64e63eff0db9c3205788d635f7fc31488315b74192352

    • Size

      616KB

    • MD5

      7a89a9e624efe2d98f3377def94cf549

    • SHA1

      980b1d129361886ace0efae85c01e7fed01930d5

    • SHA256

      8d5cd706b6f9be925bf64e63eff0db9c3205788d635f7fc31488315b74192352

    • SHA512

      78ccd6003e812532387edf6d147749a5e89380d98b84b391342b70b3805fc4fb5f4758c54c3f2054c20e500fe7ce8b8192568d919f0cffa1dff735ba7a7d319e

    • SSDEEP

      12288:Q2HYkxswcXKC2zNWfm2YRm5sm2YRm5hkxswcXKC2zNW:BHYZX9uWfm2Yysm2YyhZX9uW

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks