Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2ca8a08a83d98fbae1d8683cdb828b64216f9849ee539e09198db53876d419e9.exe
-
Size
646KB
-
Sample
240628-blybxsvhjn
-
MD5
c96c8178b1018515d4b43e614a3e3f15
-
SHA1
8a6601c7aff694ba0843e807a7a1a57bc3cb3665
-
SHA256
2ca8a08a83d98fbae1d8683cdb828b64216f9849ee539e09198db53876d419e9
-
SHA512
4d8a0d5a48264df61ed446487eca1593b3bf08633898ce4af5fc8896bdf213653ea2c426fb888ebe2ee5afeceb6f5c4ecdf84ca5155e5135aa37c0f338c163b5
-
SSDEEP
12288:V5WsXbCawKw4NN3AML30AptH5dIV46qlBghWblKOdB/yMi4ZtMn5HMbGxcbr/5vk:BwkP3AMrzZOPQ1xyMi4ZtqMbA0r/5s
Static task
static1
Behavioral task
behavioral1
Sample
2ca8a08a83d98fbae1d8683cdb828b64216f9849ee539e09198db53876d419e9.exe
Resource
win7-20240508-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.normagroup.com.tr - Port:
21 - Username:
[email protected] - Password:
Qb.X[.j.Yfm[
Targets
-
-
Target
2ca8a08a83d98fbae1d8683cdb828b64216f9849ee539e09198db53876d419e9.exe
-
Size
646KB
-
MD5
c96c8178b1018515d4b43e614a3e3f15
-
SHA1
8a6601c7aff694ba0843e807a7a1a57bc3cb3665
-
SHA256
2ca8a08a83d98fbae1d8683cdb828b64216f9849ee539e09198db53876d419e9
-
SHA512
4d8a0d5a48264df61ed446487eca1593b3bf08633898ce4af5fc8896bdf213653ea2c426fb888ebe2ee5afeceb6f5c4ecdf84ca5155e5135aa37c0f338c163b5
-
SSDEEP
12288:V5WsXbCawKw4NN3AML30AptH5dIV46qlBghWblKOdB/yMi4ZtMn5HMbGxcbr/5vk:BwkP3AMrzZOPQ1xyMi4ZtqMbA0r/5s
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-