Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
DHL9407155789.exe
-
Size
630KB
-
Sample
240318-v288xaeg6z
-
MD5
9d734afa7d130bd4a0a02c6a461b36e8
-
SHA1
878a345533c10e9aac233df91cb34a31fe34bd28
-
SHA256
e0b1bcb5ca129ff46e5623f8fb3bb079df557e688e04ce79747eb7ab8ad1d3b6
-
SHA512
7d37840add24ce90993045055654773ea91995951abffa6257ac5d4907554a1e60b0ded0d8cae0f4a1213b2c7d97c69ef1831aad29711640584c13211eb226c4
-
SSDEEP
12288:z7gRhxAMnM5zqiX+yAvZue7ze/RkPliq4hP82V6ezIDymDqZNas0uK:z8VVMdqiOZv4e7ze/ep4hPuezIDBOZNy
Static task
static1
Behavioral task
behavioral1
Sample
DHL9407155789.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
DHL9407155789.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.childs-plays.com - Port:
587 - Username:
[email protected] - Password:
yuttrge7v - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
smtp.childs-plays.com - Port:
587 - Username:
[email protected] - Password:
yuttrge7v
Targets
-
-
Target
DHL9407155789.exe
-
Size
630KB
-
MD5
9d734afa7d130bd4a0a02c6a461b36e8
-
SHA1
878a345533c10e9aac233df91cb34a31fe34bd28
-
SHA256
e0b1bcb5ca129ff46e5623f8fb3bb079df557e688e04ce79747eb7ab8ad1d3b6
-
SHA512
7d37840add24ce90993045055654773ea91995951abffa6257ac5d4907554a1e60b0ded0d8cae0f4a1213b2c7d97c69ef1831aad29711640584c13211eb226c4
-
SSDEEP
12288:z7gRhxAMnM5zqiX+yAvZue7ze/RkPliq4hP82V6ezIDymDqZNas0uK:z8VVMdqiOZv4e7ze/ep4hPuezIDBOZNy
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-