Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
0b752fc6e766a4586b694804fede655f9a28a58a93767658b4fca03fe1f30d53.exe
-
Size
1.1MB
-
Sample
240416-vpxdkshc7v
-
MD5
2285a400b8f8cf31a2cdb2972fb3f0de
-
SHA1
3502b5f7834531bccbf61c6cb3144720b5f1461a
-
SHA256
0b752fc6e766a4586b694804fede655f9a28a58a93767658b4fca03fe1f30d53
-
SHA512
0712a4bcf0ea64a364986a40065b7bc4bf61052ac758e12965d589c435e52a3eebeb726b82389bea19082af20daa86e2480b99135d502ab7b22170b113ca4229
-
SSDEEP
12288:pdjO/K8sL8kKR0zIYaGzp9t6Mde/l5KCuzAZeQzrjKEddyDZmdgc+W:qS8/pR0EYp9wMdM5Juzmz/dwD8dg
Static task
static1
Behavioral task
behavioral1
Sample
0b752fc6e766a4586b694804fede655f9a28a58a93767658b4fca03fe1f30d53.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0b752fc6e766a4586b694804fede655f9a28a58a93767658b4fca03fe1f30d53.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cphost09.qhoster.net - Port:
587 - Username:
[email protected] - Password:
[email protected] - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
cphost09.qhoster.net - Port:
587 - Username:
[email protected] - Password:
[email protected]
Targets
-
-
Target
0b752fc6e766a4586b694804fede655f9a28a58a93767658b4fca03fe1f30d53.exe
-
Size
1.1MB
-
MD5
2285a400b8f8cf31a2cdb2972fb3f0de
-
SHA1
3502b5f7834531bccbf61c6cb3144720b5f1461a
-
SHA256
0b752fc6e766a4586b694804fede655f9a28a58a93767658b4fca03fe1f30d53
-
SHA512
0712a4bcf0ea64a364986a40065b7bc4bf61052ac758e12965d589c435e52a3eebeb726b82389bea19082af20daa86e2480b99135d502ab7b22170b113ca4229
-
SSDEEP
12288:pdjO/K8sL8kKR0zIYaGzp9t6Mde/l5KCuzAZeQzrjKEddyDZmdgc+W:qS8/pR0EYp9wMdM5Juzmz/dwD8dg
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-