Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
RFQ- FOR TI TPS PART- Urgent PO.exe
-
Size
756KB
-
Sample
240610-m4fqdagh82
-
MD5
040d0bdbf5f579bcfbed3560c5decbe4
-
SHA1
f4fa659b95feceef2d94383d5915be823ab1eb71
-
SHA256
7e1260b973a411ebfed7243b187e0bea388593ee17c28d7bbea4fbd69603770f
-
SHA512
1c1676fe5149b637352106f9dc1f5df84684fa22e2cb0aea0a95364c7442ef2971016fb14ebbf29f44e862aa7b95b3d8caf3cd0a7889416edb1e0a4711ab9153
-
SSDEEP
12288:uk3qyJMbO69EVoQ8tbQ9yIMae7X/Wr835KaaHFeeD9r:P6OmO69E9pyaeb4m5KaaHFeehr
Static task
static1
Behavioral task
behavioral1
Sample
RFQ- FOR TI TPS PART- Urgent PO.exe
Resource
win7-20240508-en
Malware Config
Extracted
Protocol: smtp- Host:
shared167.accountservergroup.com - Port:
587 - Username:
[email protected] - Password:
Smartooo@1234#
Extracted
agenttesla
Protocol: smtp- Host:
shared167.accountservergroup.com - Port:
587 - Username:
[email protected] - Password:
Smartooo@1234# - Email To:
[email protected]
Targets
-
-
Target
RFQ- FOR TI TPS PART- Urgent PO.exe
-
Size
756KB
-
MD5
040d0bdbf5f579bcfbed3560c5decbe4
-
SHA1
f4fa659b95feceef2d94383d5915be823ab1eb71
-
SHA256
7e1260b973a411ebfed7243b187e0bea388593ee17c28d7bbea4fbd69603770f
-
SHA512
1c1676fe5149b637352106f9dc1f5df84684fa22e2cb0aea0a95364c7442ef2971016fb14ebbf29f44e862aa7b95b3d8caf3cd0a7889416edb1e0a4711ab9153
-
SSDEEP
12288:uk3qyJMbO69EVoQ8tbQ9yIMae7X/Wr835KaaHFeeD9r:P6OmO69E9pyaeb4m5KaaHFeehr
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-