Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
cbeb517b53913ab39c8ba111dd5a3207.bin
-
Size
636KB
-
Sample
240707-ec8m3sshnl
-
MD5
27b23815642f812b7f9e33b032696021
-
SHA1
11213a0d0d83c0e19726b05a6a5b3ee6a1f6434e
-
SHA256
9370f87a2e177c866b0c2a5a62b8dca4ccf19188e0ba05843aed40c95a4d462e
-
SHA512
5c821ad43703918c3d9a453254fb0c4cd20ec9d61674e0435ee876f4794f77630c15bae35d9f59e568d9744989daf6c7abb5e6c1e9a227bb2f6685d9160a7f13
-
SSDEEP
12288:jGf3y173Uy/s6ECH4neCZtE5TUrQ8+yGllSUwEWVfrbUSHTBV5T:2C17zU6EMUxZtE5YQFyGllS9LVf3L5T
Static task
static1
Behavioral task
behavioral1
Sample
2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe
Resource
win7-20240508-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.commtechtrading.com - Port:
587 - Username:
[email protected] - Password:
;elP@ho2Np 7[ - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.commtechtrading.com - Port:
587 - Username:
[email protected] - Password:
;elP@ho2Np 7[
Targets
-
-
Target
2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe
-
Size
662KB
-
MD5
cbeb517b53913ab39c8ba111dd5a3207
-
SHA1
23779925ad3e8f1f0406de5163b4dc3664cda102
-
SHA256
2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029
-
SHA512
71d8c31aff81c29f57f8d3d14bda47043b49d06b969bb2cfec6c88af37161c0d786dd8b47bb037ae163f1332dcd0659031d7ed5205818e8e76122d0802057f67
-
SSDEEP
12288:1FLofC1PyEWOwMH+O21d3Z7Ja5GMJPyDPXnq8LczaEeNBKLYs65cJde6t4Wcm7:1FZ19WOwMeV9IzJqDP3PLczKBKk3wdeW
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-