Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Draft Sales contract.exe
-
Size
664KB
-
Sample
240417-vq8s1ahg2z
-
MD5
e7d5b3af9cebadf634461574940da0a7
-
SHA1
1b70ed9407cbe02fbb2ea7790caba4bae4c98a29
-
SHA256
519fcde66b1b9c807cf89568d162c89103ee8065ba1009086881bbbefd69e4c9
-
SHA512
f7bb4a4a13832a6c665229aaf9fafd4cb563f794b04ede6be44713d30d13a5fe4ff77ddc33f0e68770fe8ff59c7b2372c3f1afe18de63c78159ac29aebf3749a
-
SSDEEP
12288:I33nFyHgRMph6guOtDqB/PkKhcRdK6auXh35TPy4l52IQko3MN+Evy:IlyHsIh6fOtDqdfYh39lS6or
Static task
static1
Behavioral task
behavioral1
Sample
Draft Sales contract.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Draft Sales contract.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.techwiser.in - Port:
587 - Username:
[email protected] - Password:
tech@#$121 - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.techwiser.in - Port:
587 - Username:
[email protected] - Password:
tech@#$121
Targets
-
-
Target
Draft Sales contract.exe
-
Size
664KB
-
MD5
e7d5b3af9cebadf634461574940da0a7
-
SHA1
1b70ed9407cbe02fbb2ea7790caba4bae4c98a29
-
SHA256
519fcde66b1b9c807cf89568d162c89103ee8065ba1009086881bbbefd69e4c9
-
SHA512
f7bb4a4a13832a6c665229aaf9fafd4cb563f794b04ede6be44713d30d13a5fe4ff77ddc33f0e68770fe8ff59c7b2372c3f1afe18de63c78159ac29aebf3749a
-
SSDEEP
12288:I33nFyHgRMph6guOtDqB/PkKhcRdK6auXh35TPy4l52IQko3MN+Evy:IlyHsIh6fOtDqdfYh39lS6or
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-