Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
bc49e8962d629c983a15863ef1e78d6aa221a06b3c23f4920315a21966cd7938
-
Size
2.3MB
-
Sample
240525-g4x2rshb9t
-
MD5
2776b49b2742d41cc2ff9f4cde5d3138
-
SHA1
2b232f38a2b757785e61de6afd5f158161cfb801
-
SHA256
bc49e8962d629c983a15863ef1e78d6aa221a06b3c23f4920315a21966cd7938
-
SHA512
2fb14923b839ce3fe724840038aaf1c14db59b9623976f9a529c3151f950305f3cf5f48db30d6e1856a64104b9c2ba4f81656ad09c986064c4bc98880a32f8ff
-
SSDEEP
49152:3UBJ6jQsiw11MLE8fL0baJChbjrzQOWVIT/2xclZrkrlOtTTcT4dJt06:3m4iOyfIbawhbLQri/wlO1hdw6
Static task
static1
Behavioral task
behavioral1
Sample
PO.scanned copy.jpeg.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
PO.scanned copy.jpeg.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.spia-indonesia.org - Port:
587 - Username:
[email protected] - Password:
Looloo123@# - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.spia-indonesia.org - Port:
587 - Username:
[email protected] - Password:
Looloo123@#
Targets
-
-
Target
PO.scanned copy.jpeg.exe
-
Size
2.4MB
-
MD5
07406b3baa44f755372fc1cb3d1356f6
-
SHA1
4e5864ccfca1d131d5b96b5e511ea482a8f25968
-
SHA256
9144819511f4f92e7f369d4edcf931178514957ae58256385d1909cc24bd732a
-
SHA512
a07e77de01ee4cb7e5554ea746b0fb713836a81a32d5629944516ad962fe5dd77b66b482e48c2208cae81c614f9b13a65677820327c5f15a65d0426ad4f2f4e1
-
SSDEEP
49152:H74PT9ibU8owt10HE8fH0/atMZNJXlE2ev0jJ2xylrFkV/Ytzj0lQ5plu:W4oA+fU/aCZNnENsJa/YFJ5O
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-