Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
54fdfa9d36adfcff19dc72eb5367fd33c461774d7bd24dbf201307426e121b1a
-
Size
914KB
-
Sample
240720-bfqpwszalj
-
MD5
8179c97b111f9f37b54dbebc17324243
-
SHA1
48b5fc456b271163ba67f4868682c6ab3832b26d
-
SHA256
54fdfa9d36adfcff19dc72eb5367fd33c461774d7bd24dbf201307426e121b1a
-
SHA512
2d06dbd5021bbaed40e713090f3815c11b3142558d6dcc6527f9ef77609b36f1f7aefe972b1e7877abc8053ffb8cc8564ea3ec915a9646271f0f1b1d16477418
-
SSDEEP
12288:BEfL+hExU/5q1h8BRj/VThVZ5EuAqMDfbSooDeeFcEnfPQeUiuIo9Vbw/hv+bCDc:iLGkCBNVThVZ5ExpFoDNxQtRjwk7Am
Static task
static1
Behavioral task
behavioral1
Sample
54fdfa9d36adfcff19dc72eb5367fd33c461774d7bd24dbf201307426e121b1a.exe
Resource
win7-20240704-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.comedyskits.com.ng - Port:
587 - Username:
[email protected] - Password:
H),VtEq1)5IX - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
mail.comedyskits.com.ng - Port:
587 - Username:
[email protected] - Password:
H),VtEq1)5IX
Targets
-
-
Target
54fdfa9d36adfcff19dc72eb5367fd33c461774d7bd24dbf201307426e121b1a
-
Size
914KB
-
MD5
8179c97b111f9f37b54dbebc17324243
-
SHA1
48b5fc456b271163ba67f4868682c6ab3832b26d
-
SHA256
54fdfa9d36adfcff19dc72eb5367fd33c461774d7bd24dbf201307426e121b1a
-
SHA512
2d06dbd5021bbaed40e713090f3815c11b3142558d6dcc6527f9ef77609b36f1f7aefe972b1e7877abc8053ffb8cc8564ea3ec915a9646271f0f1b1d16477418
-
SSDEEP
12288:BEfL+hExU/5q1h8BRj/VThVZ5EuAqMDfbSooDeeFcEnfPQeUiuIo9Vbw/hv+bCDc:iLGkCBNVThVZ5ExpFoDNxQtRjwk7Am
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-