Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
SPECIFICATIONS.exe
-
Size
2.5MB
-
Sample
240625-g8bz4axgrl
-
MD5
8dcde8d3e5361e46c9a0eb3a7c559b6a
-
SHA1
a2bec0f3c99c9197443bc161233ec19678172952
-
SHA256
a19e8babf5efa761ff04475ae8db2e359e1d74f19ebb81cb59c57aa07ab9390e
-
SHA512
005ccb5697e533fcbd782509cdb19c381a8bbf3af35f6282456a4236bd5793109da8b81296140496755ca608f93cde4c963f46c5d8694caf5c7c66e194de006c
-
SSDEEP
12288:l7d5M1YVb+stU0vbzqD7wngYZW34lM5G7KSvicVcDD:K1YU1UbzMOyU69eVcDD
Static task
static1
Behavioral task
behavioral1
Sample
SPECIFICATIONS.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
SPECIFICATIONS.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.ercolina-usa.com - Port:
21 - Username:
[email protected] - Password:
uy,o#mZj8$lY
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.ercolina-usa.com - Port:
21 - Username:
[email protected] - Password:
uy,o#mZj8$lY
Targets
-
-
Target
SPECIFICATIONS.exe
-
Size
2.5MB
-
MD5
8dcde8d3e5361e46c9a0eb3a7c559b6a
-
SHA1
a2bec0f3c99c9197443bc161233ec19678172952
-
SHA256
a19e8babf5efa761ff04475ae8db2e359e1d74f19ebb81cb59c57aa07ab9390e
-
SHA512
005ccb5697e533fcbd782509cdb19c381a8bbf3af35f6282456a4236bd5793109da8b81296140496755ca608f93cde4c963f46c5d8694caf5c7c66e194de006c
-
SSDEEP
12288:l7d5M1YVb+stU0vbzqD7wngYZW34lM5G7KSvicVcDD:K1YU1UbzMOyU69eVcDD
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-