Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118
-
Size
1.9MB
-
Sample
240720-kgwrzayajd
-
MD5
5fc640b52af0bd71a56f22622520e2f5
-
SHA1
52ef9db0719881a02d5d56b28c499607bccd6d95
-
SHA256
5f72eaac08827dde28d9fb7e945856329d8e06a5557557f300ae67b13f967745
-
SHA512
ca65d050aeff678152d6694c8c5e4c39d724a7fe953e757f7d9f038f61d330a7ebfd51e9776cbeab9bc289c10c08d1275ec8c98687f51cb262c7dd4f30c0567f
-
SSDEEP
24576:iavuwCYVVVxg7y61og65VQUUaoEp9W64UJKW1mPLFeCXDMDYA:zvZTVD61SVVW64UJKW1mPLFeCXDMDYA
Static task
static1
Behavioral task
behavioral1
Sample
5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.shakurjay.com - Port:
587 - Username:
[email protected] - Password:
zpwXtxm7
Targets
-
-
Target
5fc640b52af0bd71a56f22622520e2f5_JaffaCakes118
-
Size
1.9MB
-
MD5
5fc640b52af0bd71a56f22622520e2f5
-
SHA1
52ef9db0719881a02d5d56b28c499607bccd6d95
-
SHA256
5f72eaac08827dde28d9fb7e945856329d8e06a5557557f300ae67b13f967745
-
SHA512
ca65d050aeff678152d6694c8c5e4c39d724a7fe953e757f7d9f038f61d330a7ebfd51e9776cbeab9bc289c10c08d1275ec8c98687f51cb262c7dd4f30c0567f
-
SSDEEP
24576:iavuwCYVVVxg7y61og65VQUUaoEp9W64UJKW1mPLFeCXDMDYA:zvZTVD61SVVW64UJKW1mPLFeCXDMDYA
Score10/10-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Suspicious use of SetThreadContext
-