Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
cb797ed60426b219608e0d3386e0e21342edab107c10f6053adec549025b77fe
-
Size
650KB
-
Sample
240416-brpa7sdg29
-
MD5
e54b9d83c941637b24ad652de6202d44
-
SHA1
938fd5c9c6cdc30806b80a25b77343d117805b5d
-
SHA256
cb797ed60426b219608e0d3386e0e21342edab107c10f6053adec549025b77fe
-
SHA512
97c0d6b3de8ebb9fa4daea158528e432283331d001098f67849a4fcd4d80295331b876aadab0838371d6d557df9d5711042bcc3cc49c429d7ebd5657be685909
-
SSDEEP
12288:naAv7zT370S+YYHtr7MjCumGG/pbNxZk5U5Yj+4i05SphihXqRfyZZyQNn:qDl+Aa5rj+4i058YqRyGQNn
Static task
static1
Behavioral task
behavioral1
Sample
cb797ed60426b219608e0d3386e0e21342edab107c10f6053adec549025b77fe.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cb797ed60426b219608e0d3386e0e21342edab107c10f6053adec549025b77fe.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.metatron.com.mx - Port:
587 - Username:
[email protected] - Password:
M3taHondu@1 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.metatron.com.mx - Port:
587 - Username:
[email protected] - Password:
M3taHondu@1
Targets
-
-
Target
cb797ed60426b219608e0d3386e0e21342edab107c10f6053adec549025b77fe
-
Size
650KB
-
MD5
e54b9d83c941637b24ad652de6202d44
-
SHA1
938fd5c9c6cdc30806b80a25b77343d117805b5d
-
SHA256
cb797ed60426b219608e0d3386e0e21342edab107c10f6053adec549025b77fe
-
SHA512
97c0d6b3de8ebb9fa4daea158528e432283331d001098f67849a4fcd4d80295331b876aadab0838371d6d557df9d5711042bcc3cc49c429d7ebd5657be685909
-
SSDEEP
12288:naAv7zT370S+YYHtr7MjCumGG/pbNxZk5U5Yj+4i05SphihXqRfyZZyQNn:qDl+Aa5rj+4i058YqRyGQNn
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-