Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
43481bb11e0fcc3654b07c425b6a881a7e45e8ef9d22f322285804019efa8035
-
Size
137KB
-
Sample
240523-cgr5saaa28
-
MD5
cbe9dd74657f661b730ea05553730eba
-
SHA1
30881f4542f05cfd08ce28c554d4938515831291
-
SHA256
43481bb11e0fcc3654b07c425b6a881a7e45e8ef9d22f322285804019efa8035
-
SHA512
d9e30dbbfda0b192ef6c52c6f2d7f12a00a0fb4696106a8918acd98cbcd68ac1c923e7af1f4c37e2db581ee90dab4000718a93ef02a7c798942b8c50a61e11f3
-
SSDEEP
3072:TC5MyNQN3ZYkGlIk5m/r9w6Mffc38ncLQK6dJJ:+G5ZKGky9wbffHnaQKe
Static task
static1
Behavioral task
behavioral1
Sample
43481bb11e0fcc3654b07c425b6a881a7e45e8ef9d22f322285804019efa8035.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
43481bb11e0fcc3654b07c425b6a881a7e45e8ef9d22f322285804019efa8035.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7134623757:AAG14l2IijdHtUMTQB8PlsH-2xdwM6WlmzQ/
Targets
-
-
Target
43481bb11e0fcc3654b07c425b6a881a7e45e8ef9d22f322285804019efa8035
-
Size
137KB
-
MD5
cbe9dd74657f661b730ea05553730eba
-
SHA1
30881f4542f05cfd08ce28c554d4938515831291
-
SHA256
43481bb11e0fcc3654b07c425b6a881a7e45e8ef9d22f322285804019efa8035
-
SHA512
d9e30dbbfda0b192ef6c52c6f2d7f12a00a0fb4696106a8918acd98cbcd68ac1c923e7af1f4c37e2db581ee90dab4000718a93ef02a7c798942b8c50a61e11f3
-
SSDEEP
3072:TC5MyNQN3ZYkGlIk5m/r9w6Mffc38ncLQK6dJJ:+G5ZKGky9wbffHnaQKe
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-