Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d53a9ad859e7ee98445a7af7c659feff_JaffaCakes118

  • Size

    455KB

  • Sample

    240908-2q7dha1hqg

  • MD5

    d53a9ad859e7ee98445a7af7c659feff

  • SHA1

    c4f302837156e3272d565674475e158fc0de7c38

  • SHA256

    03dd9a5f37cef2c357b6b0a24fba2b5de8bffebb127ae2e6d85791df081c84e5

  • SHA512

    b03601e870149d3805086da6d251e4e522ace45a7dc56d3659e0ee216303c645b2776b7b3ffb443e38fb45a74dda959a988be2ccb71dd2d6a1e68a09a381b104

  • SSDEEP

    12288:K0Psr72qOnSDdfgspkBzEF0Vc8SXRHQLABGvZzOP8eCV4iAwH9AR6b:m2vSBLkQ0y8wLUFcg99

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.desmaindian.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    (*IlJex6

Targets

    • Target

      Order__Food Additive.exe

    • Size

      855KB

    • MD5

      49c1965c475ad1684b9fd6ccdcba5019

    • SHA1

      43594d32d9461906c36e86d278f406bfcf94cfb3

    • SHA256

      69f0b47ce8a9aea88c84a436e06a6569715461960f48fa5b10af6b7ae0b94202

    • SHA512

      d0aa2fa1fe69a0e7d7fdfae20d593ce63cb3cba3940c3eeb4bba4d723918f50418e135e9043220247985f0b3ebad2ac45ecb0a52e92308553dcc6264edf8deea

    • SSDEEP

      12288:q6+mn9A32uu5hZqBnxeu5cfM+BIjvTxGKUlOtzz1Lww40nBsRRFNWoyVbq/8XOmi:q6d97ZMmNgTBJ1oQ6lNWLpq/8emyT

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • AgentTesla payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Drops startup file

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks