Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
45d0c2ec2ede02e8b8ef535346a4e7e06fd52ba27995a15a5f1a0b11e305d4f7.exe
-
Size
806KB
-
Sample
240705-bnqpvs1ejh
-
MD5
63128eeca6e0dabeddfd68c0517d4c91
-
SHA1
eb43eb41464d255d312b6b2aa14428ccd16156da
-
SHA256
45d0c2ec2ede02e8b8ef535346a4e7e06fd52ba27995a15a5f1a0b11e305d4f7
-
SHA512
73fabc52ee53b8ab3e70006c058ad6718b00cdc8259eccb7e545e7223d1cff7f84d670788484b6fdb59ef4930162d0ccbe83f2af4f1ab9fdc3d0577e9a767547
-
SSDEEP
12288:dLYjofC1PHG1ub2dwZEWBMlQrpNO4904kZwB2JYoUev4y1VJznHhtbKOVDyTVoy:+1m1utZqi9gI0qB2JYofQOznHhhKGy
Static task
static1
Behavioral task
behavioral1
Sample
45d0c2ec2ede02e8b8ef535346a4e7e06fd52ba27995a15a5f1a0b11e305d4f7.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
45d0c2ec2ede02e8b8ef535346a4e7e06fd52ba27995a15a5f1a0b11e305d4f7.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
nffplp.com - Port:
587 - Username:
[email protected] - Password:
$Nke%8XIIDtm - Email To:
[email protected]
Targets
-
-
Target
45d0c2ec2ede02e8b8ef535346a4e7e06fd52ba27995a15a5f1a0b11e305d4f7.exe
-
Size
806KB
-
MD5
63128eeca6e0dabeddfd68c0517d4c91
-
SHA1
eb43eb41464d255d312b6b2aa14428ccd16156da
-
SHA256
45d0c2ec2ede02e8b8ef535346a4e7e06fd52ba27995a15a5f1a0b11e305d4f7
-
SHA512
73fabc52ee53b8ab3e70006c058ad6718b00cdc8259eccb7e545e7223d1cff7f84d670788484b6fdb59ef4930162d0ccbe83f2af4f1ab9fdc3d0577e9a767547
-
SSDEEP
12288:dLYjofC1PHG1ub2dwZEWBMlQrpNO4904kZwB2JYoUev4y1VJznHhtbKOVDyTVoy:+1m1utZqi9gI0qB2JYofQOznHhhKGy
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-