Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
MV ENISHI V.53Y DETAILS.pdf.lzh
-
Size
653KB
-
Sample
240612-jgvz1avcjd
-
MD5
542de40e1447501c9da3c104e0bb80f4
-
SHA1
913994b1adac2f50be6a616851ebfd8829770533
-
SHA256
fed028a679ea3f72b741ae679e13f769de49e5dd0cac19e155cb0e233c0f2da1
-
SHA512
ed9078ba5d49f6960630caaadb2fec1072dbb4395fe5ff143a1263e7502c3835ba503469c79855ff5114607a51c1f0aa5c429d1e94df5fd24e99f295a8fbf3bc
-
SSDEEP
12288:iYPjnRHU/70sDTTj2HyOQHgdTlKIeGM2KJpxgGRYB4RVYuJFVqc0tsoHfUXNgL:iYPaTDTHFOQATlSSKSGfxJWc0tNmo
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Extracted
Protocol: ftp- Host:
beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Targets
-
-
Target
MV ENISHI V.53Y DETAILS.pdf.scr
-
Size
674KB
-
MD5
ce60d02b1ca0b5b40cfdc6da5ca7da18
-
SHA1
8bcbf2b9057029a841d6c930c66558d216aabbc7
-
SHA256
dc343098d5fdbd96756e603f4d75f7e3658887aee0c65d886c4d2f18e9cc6b64
-
SHA512
f7e6ea9dcc557d0e2dd59fa4a18b35532f45072f9b1a9dbe5cc09f7a74a6a7c54e441fa0d375b872ac74927177df511cbd737ea17f2d50c45e7405d6d7f94326
-
SSDEEP
12288:HHY2iNStcY1crIXavl9Tjtgj8OX2nt/+XXm/3EbZMDFMwx12VrJ:HHY1Mci7Xa71w8vF+XX8IiDFMc12N
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-