Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1744c8efded2515503c43e3d2585b4bad66a974ff1548493fbe6631369cb5362
-
Size
730KB
-
Sample
240416-ccgs9agd5t
-
MD5
3d49996fc8dc8838d6734e6b67231aa1
-
SHA1
8b41df1f2433e1a5c98e2d5f58c99fa73886a586
-
SHA256
1744c8efded2515503c43e3d2585b4bad66a974ff1548493fbe6631369cb5362
-
SHA512
33f688ff4cec62ede990d1c7ba41542a513df1eb2e4579fc8f0190b93f2fdb81bb3e5cc276dc107f464cd058152cd65f4a2f1e31f7c05d9bfc392cc2a2b299a4
-
SSDEEP
12288:qOkWgZFIR8kuRazIYyGzp/teIje/lDKMuHm0lmpfYk9MU3k8PpuJ:qO7g3PrRaEYB/4IjMDNuH9+Ak6Ck8Ppy
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cphost09.qhoster.net - Port:
587 - Username:
[email protected] - Password:
[email protected] - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
cphost09.qhoster.net - Port:
587 - Username:
[email protected] - Password:
[email protected]
Targets
-
-
Target
DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe
-
Size
1.1MB
-
MD5
2285a400b8f8cf31a2cdb2972fb3f0de
-
SHA1
3502b5f7834531bccbf61c6cb3144720b5f1461a
-
SHA256
0b752fc6e766a4586b694804fede655f9a28a58a93767658b4fca03fe1f30d53
-
SHA512
0712a4bcf0ea64a364986a40065b7bc4bf61052ac758e12965d589c435e52a3eebeb726b82389bea19082af20daa86e2480b99135d502ab7b22170b113ca4229
-
SSDEEP
12288:pdjO/K8sL8kKR0zIYaGzp9t6Mde/l5KCuzAZeQzrjKEddyDZmdgc+W:qS8/pR0EYp9wMdM5Juzmz/dwD8dg
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-