Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0e8fcdc410b7e7cd6c985a9a6edda567e1734578fd9e27ed360515227880d266

  • Size

    741KB

  • Sample

    240521-bjrrcsdc24

  • MD5

    0a6d11b6c53602ee2fad4043440d66df

  • SHA1

    4b519750d731eb9067e64f07f3de5df62ea2263f

  • SHA256

    0e8fcdc410b7e7cd6c985a9a6edda567e1734578fd9e27ed360515227880d266

  • SHA512

    48693fc8d8bcd37be69b424665e459542b39872da139acb2a5ecd2686e0a2acf636a1f089df146d67a072b2af9f20816efbef65e689003b5906b653660c4a4ca

  • SSDEEP

    12288:QfLq6svbQRuLxu1AboxtOnUwgOFoE0aWTjyLEUpcyXOxBPrwF7b5Ai7nETqBBzTU:Qfjs7xu1NvIJdi1aNAUpcygeb5ADqplA

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      0e8fcdc410b7e7cd6c985a9a6edda567e1734578fd9e27ed360515227880d266

    • Size

      741KB

    • MD5

      0a6d11b6c53602ee2fad4043440d66df

    • SHA1

      4b519750d731eb9067e64f07f3de5df62ea2263f

    • SHA256

      0e8fcdc410b7e7cd6c985a9a6edda567e1734578fd9e27ed360515227880d266

    • SHA512

      48693fc8d8bcd37be69b424665e459542b39872da139acb2a5ecd2686e0a2acf636a1f089df146d67a072b2af9f20816efbef65e689003b5906b653660c4a4ca

    • SSDEEP

      12288:QfLq6svbQRuLxu1AboxtOnUwgOFoE0aWTjyLEUpcyXOxBPrwF7b5Ai7nETqBBzTU:Qfjs7xu1NvIJdi1aNAUpcygeb5ADqplA

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks