Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

213d83b52d...KI.exe

windows7-x64

10

213d83b52d...KI.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    213d83b52d115195c82efa9f68fbd360_NEIKI

  • Size

    1.0MB

  • Sample

    240507-y22evadg6z

  • MD5

    213d83b52d115195c82efa9f68fbd360

  • SHA1

    b14a7978515b01fcc38d4ca5139101cd57c80c99

  • SHA256

    953cc03bcf78e6505b9fcf232e58be836b273898634858c36b8328d18f74d85d

  • SHA512

    8c200379f9f122092cb0041d9aea071d82160b432585dde803171892fadf5faae13dcbbe44921389648620da07cd14b5537959fa83edae07800ccd35dff3b073

  • SSDEEP

    24576:hqDEvCTbMWu7rQYlBQcBiT6rprG8a+dUxnD:hTvC/MTQYxsWR7a+wn

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.midhcodistribuciones.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    ,A7}+JV4KExQ

Targets

    • Target

      213d83b52d115195c82efa9f68fbd360_NEIKI

    • Size

      1.0MB

    • MD5

      213d83b52d115195c82efa9f68fbd360

    • SHA1

      b14a7978515b01fcc38d4ca5139101cd57c80c99

    • SHA256

      953cc03bcf78e6505b9fcf232e58be836b273898634858c36b8328d18f74d85d

    • SHA512

      8c200379f9f122092cb0041d9aea071d82160b432585dde803171892fadf5faae13dcbbe44921389648620da07cd14b5537959fa83edae07800ccd35dff3b073

    • SSDEEP

      24576:hqDEvCTbMWu7rQYlBQcBiT6rprG8a+dUxnD:hTvC/MTQYxsWR7a+wn

    Score
    10/10
    agentteslakeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks