Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
AE23SDS04-3 BL.z
-
Size
686KB
-
Sample
240417-ldrvaacd9t
-
MD5
d5db9ee8c6502979187bd03d07242915
-
SHA1
85cefbee57f4f4912a81631eb664afdf9962096e
-
SHA256
82f32be71d9c226d53658209924e4e534383b0db5481dbd49923692ef5666940
-
SHA512
e3732c42e867555e13453cc60062c3c4ef6909aafe84d8fc9d601133e122c3af705db9e159bb36bfc0499dd8b505cf23b838aaa364d7f64fbb8e6408177b29e3
-
SSDEEP
12288:5sSnEw8i28IGrqd1F1Wlw7OjOv8MoVgNoVsbzGXZdOVVeLZaKk5Tu9:LnEw8i2MrI1F1yw7OjW8M5oUGjOVULZT
Static task
static1
Behavioral task
behavioral1
Sample
AE23SDS04-3 BL.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
AE23SDS04-3 BL.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.tabcoeng.ir - Port:
587 - Username:
[email protected] - Password:
Jh2cWb0NSjC{ - Email To:
[email protected]
Targets
-
-
Target
AE23SDS04-3 BL.z
-
Size
686KB
-
MD5
d5db9ee8c6502979187bd03d07242915
-
SHA1
85cefbee57f4f4912a81631eb664afdf9962096e
-
SHA256
82f32be71d9c226d53658209924e4e534383b0db5481dbd49923692ef5666940
-
SHA512
e3732c42e867555e13453cc60062c3c4ef6909aafe84d8fc9d601133e122c3af705db9e159bb36bfc0499dd8b505cf23b838aaa364d7f64fbb8e6408177b29e3
-
SSDEEP
12288:5sSnEw8i28IGrqd1F1Wlw7OjOv8MoVgNoVsbzGXZdOVVeLZaKk5Tu9:LnEw8i2MrI1F1yw7OjW8M5oUGjOVULZT
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-