Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Invptapayment19032024.exe
-
Size
617KB
-
Sample
240319-j8zr9sfe2t
-
MD5
9da1c1003343966cb14acd150070a54f
-
SHA1
6bdb294279f50e4e6ad270664c9733acd4d586de
-
SHA256
3a93ebec868141d7e6d804c825c79934f5db6b72825c74635b9f6c0f98217b76
-
SHA512
09f09459ec7ef3b4fa777b3ce2a30ec385cea44878d9ee02c91fcb06f2f32199534b15d1020605c27e1e3b6e801f38a19a528728882f554f56a4314bb2a2bfef
-
SSDEEP
12288:JjWm+U8a9nFn6D+hbpZZMxInHoLnJK1dQPLeKS8VtMpOJRYWq:YmFnQ2b3uxInuJKrQzet83mOJb
Static task
static1
Behavioral task
behavioral1
Sample
Invptapayment19032024.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Invptapayment19032024.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.jeepcommerce.rs - Port:
21 - Username:
[email protected] - Password:
q[0r3BqZHV[u
Extracted
Protocol: ftp- Host:
ftp.jeepcommerce.rs - Port:
21 - Username:
[email protected] - Password:
q[0r3BqZHV[u
Targets
-
-
Target
Invptapayment19032024.exe
-
Size
617KB
-
MD5
9da1c1003343966cb14acd150070a54f
-
SHA1
6bdb294279f50e4e6ad270664c9733acd4d586de
-
SHA256
3a93ebec868141d7e6d804c825c79934f5db6b72825c74635b9f6c0f98217b76
-
SHA512
09f09459ec7ef3b4fa777b3ce2a30ec385cea44878d9ee02c91fcb06f2f32199534b15d1020605c27e1e3b6e801f38a19a528728882f554f56a4314bb2a2bfef
-
SSDEEP
12288:JjWm+U8a9nFn6D+hbpZZMxInHoLnJK1dQPLeKS8VtMpOJRYWq:YmFnQ2b3uxInuJKrQzet83mOJb
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-