Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    27.exe

  • Size

    521KB

  • Sample

    240318-x7867sgd95

  • MD5

    b29fbc48ad3305f4dcab0be3145682a6

  • SHA1

    73152dd5e9cdf69d7ae9ff114aa818b2ec0decfb

  • SHA256

    104ae348871545562f1f0a2712ddb88659fda045dd969affd79fbdc25fc7e2fd

  • SHA512

    5111621a6bfd323812eed98e1053bde36598c1fb719e7c401a090d5ee679aee02f59d0337cf0f4fed780fbb4550add1cf812203e59efedb531081cf43931e838

  • SSDEEP

    12288:zbiKz52aC1sP906WMPTxgt8UnlQJAHCUkO/tRqUjRQ1F5CZTAujRM:Tl2af9061uKyOJCCUb7qUjRQsN

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.processengrg.com
  • Port:
    587
  • Username:
    info@processengrg.com
  • Password:
    Bigbrain2022#

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.processengrg.com
  • Port:
    587
  • Username:
    info@processengrg.com
  • Password:
    Bigbrain2022#
  • Email To:
    militarybase1578@gmail.com

Targets

    • Target

      27.exe

    • Size

      521KB

    • MD5

      b29fbc48ad3305f4dcab0be3145682a6

    • SHA1

      73152dd5e9cdf69d7ae9ff114aa818b2ec0decfb

    • SHA256

      104ae348871545562f1f0a2712ddb88659fda045dd969affd79fbdc25fc7e2fd

    • SHA512

      5111621a6bfd323812eed98e1053bde36598c1fb719e7c401a090d5ee679aee02f59d0337cf0f4fed780fbb4550add1cf812203e59efedb531081cf43931e838

    • SSDEEP

      12288:zbiKz52aC1sP906WMPTxgt8UnlQJAHCUkO/tRqUjRQ1F5CZTAujRM:Tl2af9061uKyOJCCUb7qUjRQsN

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.