Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    41f42c51eae4e230acff3a90db82fbaac022ee71c91eae7478069792833fc3f9.zip

  • Size

    618KB

  • Sample

    240620-bkd7navdpm

  • MD5

    65e5bb4561a24518a6577056a5183e66

  • SHA1

    678e210840b37275befdeef777656064156a5ee7

  • SHA256

    41f42c51eae4e230acff3a90db82fbaac022ee71c91eae7478069792833fc3f9

  • SHA512

    c5f2a956ae7f664d09c71b8da0440693aa82f0ae722ece6d427f8d5dd320a2cdb87c219f0a72c09fcf207923a0224a166541b65a7de221ffedfdc3142873cc64

  • SSDEEP

    12288:PVtXxTQVIDo3oU204UOS2S7NEzDa2HQsphlonp5+Alg1iCy46dRKFXlGHB80:NbRJUCUV20EqhiKIECSdRiS

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      shipping documents.exe

    • Size

      663KB

    • MD5

      dd1c0c05fece823d0c57d0c507e9deb2

    • SHA1

      cfad01e0218e8ccc2adf740edc8bc594a0b3cd20

    • SHA256

      ba5b16c28def8e5d0ea0a09bf25b4d980fe89e3537f7034d775ccdf3bd9f5035

    • SHA512

      cd186111b32a33e23a9af82e986415ab45a75176248c5b3c178330fee14824dae5ff9ee2a90c84cb1f481ea22fdc9462f80411e0ffaf5d9080d722c3e7244272

    • SSDEEP

      12288:eFIsPALKLE97fl/JJ1B+7rdVYBbP7NYzDa2HQUphVonpX+Apg1k/oNRKFXlXDtkA:4IK+dlL1BSrdCB9YqhUKKVNRiNLznZ

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Detect packed .NET executables. Mostly AgentTeslaV4.

    • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

    • Detects executables packed with SmartAssembly

    • Detects executables referencing Windows vault credential objects. Observed in infostealers

    • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

    • Detects executables referencing many email and collaboration clients. Observed in information stealers

    • Detects executables referencing many file transfer clients. Observed in information stealers

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks