Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
b8c81808e93351d18459cd2811bfcc52857914d604aa9a6eafdd23ca0b8c64fc
-
Size
656KB
-
Sample
240617-blxqdsxdnc
-
MD5
ee6a1929cfb2da03e10033b256bb82f0
-
SHA1
6fe062b31c74aa9e8c4bf23123783db944b45c39
-
SHA256
b8c81808e93351d18459cd2811bfcc52857914d604aa9a6eafdd23ca0b8c64fc
-
SHA512
0278acfcab5004d92f844c487f2df052e8674fc71a02590125b8eaf8efbde61e2297509a14744428666d3e80e24e4314ec8606ca2619ef62fe7f98fd5817216f
-
SSDEEP
12288:MXi8LkpEapiueXv5iMCnfKjA8EP1LsA97aAC6Rp1J8yz/5k8gujfsifxlp:MyjETJ/5MeU9L/9eANRp1b5kSx
Static task
static1
Behavioral task
behavioral1
Sample
b8c81808e93351d18459cd2811bfcc52857914d604aa9a6eafdd23ca0b8c64fc.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b8c81808e93351d18459cd2811bfcc52857914d604aa9a6eafdd23ca0b8c64fc.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.midhcodistribuciones.com - Port:
21 - Username:
[email protected] - Password:
,A7}+JV4KExQ
Extracted
Protocol: ftp- Host:
ftp.midhcodistribuciones.com - Port:
21 - Username:
[email protected] - Password:
,A7}+JV4KExQ
Targets
-
-
Target
b8c81808e93351d18459cd2811bfcc52857914d604aa9a6eafdd23ca0b8c64fc
-
Size
656KB
-
MD5
ee6a1929cfb2da03e10033b256bb82f0
-
SHA1
6fe062b31c74aa9e8c4bf23123783db944b45c39
-
SHA256
b8c81808e93351d18459cd2811bfcc52857914d604aa9a6eafdd23ca0b8c64fc
-
SHA512
0278acfcab5004d92f844c487f2df052e8674fc71a02590125b8eaf8efbde61e2297509a14744428666d3e80e24e4314ec8606ca2619ef62fe7f98fd5817216f
-
SSDEEP
12288:MXi8LkpEapiueXv5iMCnfKjA8EP1LsA97aAC6Rp1J8yz/5k8gujfsifxlp:MyjETJ/5MeU9L/9eANRp1b5kSx
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-