Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    AE23SDS04-3 BL.z

  • Size

    686KB

  • Sample

    240417-ldrvaacd9t

  • MD5

    d5db9ee8c6502979187bd03d07242915

  • SHA1

    85cefbee57f4f4912a81631eb664afdf9962096e

  • SHA256

    82f32be71d9c226d53658209924e4e534383b0db5481dbd49923692ef5666940

  • SHA512

    e3732c42e867555e13453cc60062c3c4ef6909aafe84d8fc9d601133e122c3af705db9e159bb36bfc0499dd8b505cf23b838aaa364d7f64fbb8e6408177b29e3

  • SSDEEP

    12288:5sSnEw8i28IGrqd1F1Wlw7OjOv8MoVgNoVsbzGXZdOVVeLZaKk5Tu9:LnEw8i2MrI1F1yw7OjW8M5oUGjOVULZT

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      AE23SDS04-3 BL.z

    • Size

      686KB

    • MD5

      d5db9ee8c6502979187bd03d07242915

    • SHA1

      85cefbee57f4f4912a81631eb664afdf9962096e

    • SHA256

      82f32be71d9c226d53658209924e4e534383b0db5481dbd49923692ef5666940

    • SHA512

      e3732c42e867555e13453cc60062c3c4ef6909aafe84d8fc9d601133e122c3af705db9e159bb36bfc0499dd8b505cf23b838aaa364d7f64fbb8e6408177b29e3

    • SSDEEP

      12288:5sSnEw8i28IGrqd1F1Wlw7OjOv8MoVgNoVsbzGXZdOVVeLZaKk5Tu9:LnEw8i2MrI1F1yw7OjW8M5oUGjOVULZT

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks