Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Aramis_CCS_PJT_REQ_Material_RFQ_Details_Rev0.rar.crdownload

  • Size

    656KB

  • Sample

    240510-s79qhsdc8z

  • MD5

    fef3bb6a1da231de30ae15714019ed47

  • SHA1

    e803d57416d1ae47d8f7ff459f3111c0c3d11aee

  • SHA256

    1b90327b707317c5e166e64fbd1c6baad64a861334ccbb108dcd08f8a3aa88ec

  • SHA512

    e409d8ad89368c4cd526fa47f57f0758237b7ad18c7b877aa3e67c0cfc20cbe8bd84c39c54651b7a3cd02a3c488992909aee4c11da0ec369b741cc4ff9d3260f

  • SSDEEP

    12288:EuNWDqS/O0K4UtkFPLWJ9MQySjTEuFuEYKLq5tYqMISNbHb:E+83PKVehC9MQDEypdq9SNzb

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      Material_Technical Spec_Details_Rev0.exe

    • Size

      364KB

    • MD5

      19c29717d46cf4992535f2610897ecc2

    • SHA1

      05beae427373ca23470fd845f6cd5e474832a542

    • SHA256

      6522e1cbb35d2fa5a99b7c723852d05b8c7ebabd3bef0efb6778e4981e34dfc3

    • SHA512

      d78b973ad9f1ad802797853a422ec54ba0358c3450459074c562053bf16da85448e7b994210edf69d6d8e5545caac80f1d79439b75c24f6631482998ea717d82

    • SSDEEP

      6144:L/c/43APFfoB1DQU1jrFYEcFLhmFEuk+k1MrB+BKnU4NGHXnzo+DwcUyaelm:LR3efoB1hHEwufQB+BKnU4NG3k+Dpr4

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      d6f54d2cefdf58836805796f55bfc846

    • SHA1

      b980addc1a755b968dd5799179d3b4f1c2de9d2d

    • SHA256

      f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9

    • SHA512

      ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db

    • SSDEEP

      192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw

    Score
    3/10
    • Target

      Project_Items_Materials Spec_Details_Rev0.exe

    • Size

      343KB

    • MD5

      3de33761d18c33ebbf8e9d0d8f17aab1

    • SHA1

      f62a08e7b8a49fb51b7a19b56462ed74a6489cde

    • SHA256

      fab9809b4f04191f935e53c298de6a0d0c23e4d2589fc60a2e06c5735f70866a

    • SHA512

      e3b91ec66d2471e4b5ab1c1a64a20c59dac1fba911c06c18b59722d7d808572e0d9951a03eb2f4aad797920bfc433e199fcfff71c81eb64d06aa67473f393dcd

    • SSDEEP

      6144:O/c/43APFfobmbCkegPds+3F6O3MOLS29SIcBj7XQkjjMPEqDSGgS:OR3efobm+Quy4O3PO2cIcd73jMPEqDSc

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      d6f54d2cefdf58836805796f55bfc846

    • SHA1

      b980addc1a755b968dd5799179d3b4f1c2de9d2d

    • SHA256

      f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9

    • SHA512

      ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db

    • SSDEEP

      192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks