Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a38a68772404966ad8affbda6c025b82_JaffaCakes118
-
Size
540KB
-
Sample
240817-wgrzka1fqj
-
MD5
a38a68772404966ad8affbda6c025b82
-
SHA1
1e3dd48805525f360e27496f21f400d75540c8c2
-
SHA256
4faf605050ae11ae07281fef9fd15f8ea2669c3d028355a1f6b4d478572da015
-
SHA512
dba1fa3118bf550e0a93f9dab99759560cd610de6850a4ffb3a6d1d3716bb3204becf96af480906869c5246b13cf2af9a80f9d3cd688bb8461035400c8a15faf
-
SSDEEP
6144:2+RT7CqbBWgimJQlANC7RyLpeB4bzMbnOnLbvnaj8DwdEcVkuoNPSxvfKpvzGDo5:2ACqc3mJME8EeBIa0bvcEpxSU1GmvZ
Static task
static1
Behavioral task
behavioral1
Sample
a38a68772404966ad8affbda6c025b82_JaffaCakes118.exe
Resource
win7-20240708-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.renlk.me - Port:
587 - Username:
[email protected] - Password:
j*E@Hj}RaXJb
Targets
-
-
Target
a38a68772404966ad8affbda6c025b82_JaffaCakes118
-
Size
540KB
-
MD5
a38a68772404966ad8affbda6c025b82
-
SHA1
1e3dd48805525f360e27496f21f400d75540c8c2
-
SHA256
4faf605050ae11ae07281fef9fd15f8ea2669c3d028355a1f6b4d478572da015
-
SHA512
dba1fa3118bf550e0a93f9dab99759560cd610de6850a4ffb3a6d1d3716bb3204becf96af480906869c5246b13cf2af9a80f9d3cd688bb8461035400c8a15faf
-
SSDEEP
6144:2+RT7CqbBWgimJQlANC7RyLpeB4bzMbnOnLbvnaj8DwdEcVkuoNPSxvfKpvzGDo5:2ACqc3mJME8EeBIa0bvcEpxSU1GmvZ
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Suspicious use of SetThreadContext
-