Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6a31f54219ee0ddbfcb2aa841f922d48a849b1b047b8693ff8c2faad2ab8fac4
-
Size
812KB
-
Sample
240710-bh8ngsxbmk
-
MD5
ca698d84fc93036b8e8269a173380448
-
SHA1
233c29bb87c7ee1d252854dc90a8dbbf9f6e5d76
-
SHA256
6a31f54219ee0ddbfcb2aa841f922d48a849b1b047b8693ff8c2faad2ab8fac4
-
SHA512
e1cd052c2d442437eab1fd57d5b357c915669f18d5b4cc04bc49543301990f2bb955673c4ef97e746e7b2cab9faa9ac10930043918a8c1a420141de989427bec
-
SSDEEP
24576:WTCBK8jt7SS2KlHSSpKycXXb7xJFIun8LuUWPLy:WslXKp7nd8iJLy
Static task
static1
Behavioral task
behavioral1
Sample
6a31f54219ee0ddbfcb2aa841f922d48a849b1b047b8693ff8c2faad2ab8fac4.exe
Resource
win7-20240705-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.antoniomayol.com:21 - Port:
21 - Username:
[email protected] - Password:
cMhKDQUk1{;%
Extracted
Protocol: ftp- Host:
ftp.antoniomayol.com - Port:
21 - Username:
[email protected] - Password:
cMhKDQUk1{;%
Targets
-
-
Target
6a31f54219ee0ddbfcb2aa841f922d48a849b1b047b8693ff8c2faad2ab8fac4
-
Size
812KB
-
MD5
ca698d84fc93036b8e8269a173380448
-
SHA1
233c29bb87c7ee1d252854dc90a8dbbf9f6e5d76
-
SHA256
6a31f54219ee0ddbfcb2aa841f922d48a849b1b047b8693ff8c2faad2ab8fac4
-
SHA512
e1cd052c2d442437eab1fd57d5b357c915669f18d5b4cc04bc49543301990f2bb955673c4ef97e746e7b2cab9faa9ac10930043918a8c1a420141de989427bec
-
SSDEEP
24576:WTCBK8jt7SS2KlHSSpKycXXb7xJFIun8LuUWPLy:WslXKp7nd8iJLy
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-