Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
07102024_1350_05102024_INQ No.KP-20-00-PS-PI-INQ-0024-PDF.rar
-
Size
740KB
-
Sample
241007-q5k82asckd
-
MD5
abe52a70be056404eff7f259678c7d92
-
SHA1
3daf4d8e4cf9e53962423779c828b052f23a58f5
-
SHA256
7dc51b672257b79c7f40b828c682d96df761e8f238bc6af2c70b0fd71295f814
-
SHA512
83826f0cdfa0b5be66fc6d1df4875219ec2ee895c96d7c3a1a31107e1d65eeed1b261be69656c6e02ed975d40e614177fe5380223b1a0817d8d809a1556f99c7
-
SSDEEP
12288:SUPVfPEAk0bBilG1do54iiVlcU9AaSnorUJ0NwH+4BbPg3lstUlKmP/QIBe0yz+8:FXk0FilGDo54igAaOuCmMPg3utcLU0z8
Static task
static1
Behavioral task
behavioral1
Sample
INQ No.KP-20-00-PS-PI-INQ-0024-PDF.exe
Resource
win7-20240903-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
srv.masternic.net - Port:
587 - Username:
[email protected] - Password:
-H{2Szxi!%qb - Email To:
[email protected]
Targets
-
-
Target
INQ No.KP-20-00-PS-PI-INQ-0024-PDF.exe
-
Size
1.1MB
-
MD5
78b0bb9a7f63b40737f5ceb0137bb26c
-
SHA1
8b82a5a3a68d6a4a6c987d01e9fd963559b70583
-
SHA256
a8b8473c1526f9fbbb090f0f5bb1d2f1c95009c08af417cfdc5641785e4fa901
-
SHA512
082509a8e92dd0997771ac4f7a553748ce9bd7162af09915f668888e1cbe52b6a73035cee3319cb88a14e11044411f25a3a94707c69f7b0e59fa96f255c73afb
-
SSDEEP
12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLQ7y2/BYIhHvVkTPgNurVWQoNKUqUjT:ffmMv6Ckr7Mny5QLQ7y+YC4OuTohrD
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext
-