Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ed8322ff548bb52e651280261381b3e23e97d7d4478fa7f51caf21c61485626d
-
Size
386KB
-
Sample
240508-bs6xmsdf97
-
MD5
7ce0e6c063eccdb454a0ce7ccd0654a8
-
SHA1
5d38594a2104ba5054b8818bde6d5757cf869806
-
SHA256
ed8322ff548bb52e651280261381b3e23e97d7d4478fa7f51caf21c61485626d
-
SHA512
c764faa1fb51501708e7558db3d2c07e11f6ac9242ed2c889ba55ebf3c8251bf81c2e820ce5ca07abbb754d34c131661c697c98edfa7aab0f100a9503d3d059e
-
SSDEEP
12288:H7LIo1KCPQsfHnfx0aHx/JpFycqOC/x5:HIejP5f/x0MHqO+
Static task
static1
Behavioral task
behavioral1
Sample
ed8322ff548bb52e651280261381b3e23e97d7d4478fa7f51caf21c61485626d.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ed8322ff548bb52e651280261381b3e23e97d7d4478fa7f51caf21c61485626d.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6240128422:AAGLQbyR3zUrBSC7L4vc4gkYyOSOKuxj8fw/
Targets
-
-
Target
ed8322ff548bb52e651280261381b3e23e97d7d4478fa7f51caf21c61485626d
-
Size
386KB
-
MD5
7ce0e6c063eccdb454a0ce7ccd0654a8
-
SHA1
5d38594a2104ba5054b8818bde6d5757cf869806
-
SHA256
ed8322ff548bb52e651280261381b3e23e97d7d4478fa7f51caf21c61485626d
-
SHA512
c764faa1fb51501708e7558db3d2c07e11f6ac9242ed2c889ba55ebf3c8251bf81c2e820ce5ca07abbb754d34c131661c697c98edfa7aab0f100a9503d3d059e
-
SSDEEP
12288:H7LIo1KCPQsfHnfx0aHx/JpFycqOC/x5:HIejP5f/x0MHqO+
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-