Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    6fb113cfb61cd4d3ea3e3770831687bb10fb44410883d59b23ff4e5680b6bdf5

  • Size

    722KB

  • Sample

    241124-bwfjvstjal

  • MD5

    8a0365c7848f6a958c266fe37d542b9c

  • SHA1

    0bc4cea89b794f85d717095c7ccf8980e444630c

  • SHA256

    6fb113cfb61cd4d3ea3e3770831687bb10fb44410883d59b23ff4e5680b6bdf5

  • SHA512

    9fbc057efe83962329f664159d41272c2fd685d38714f7343f605a2e7e7f89b2eb58d373e1ad2a7ae9cf8e3b1c869ee07c49d1fd63ab2cc5f6da00adf5ebdee6

  • SSDEEP

    12288:e0RUzZDRJxRW2YjW4WsGs1l8i/8sCHcOtGrc:e0RUzN7R4WsGs78iFCh

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    !xgapua3

Targets

    • Target

      6fb113cfb61cd4d3ea3e3770831687bb10fb44410883d59b23ff4e5680b6bdf5

    • Size

      722KB

    • MD5

      8a0365c7848f6a958c266fe37d542b9c

    • SHA1

      0bc4cea89b794f85d717095c7ccf8980e444630c

    • SHA256

      6fb113cfb61cd4d3ea3e3770831687bb10fb44410883d59b23ff4e5680b6bdf5

    • SHA512

      9fbc057efe83962329f664159d41272c2fd685d38714f7343f605a2e7e7f89b2eb58d373e1ad2a7ae9cf8e3b1c869ee07c49d1fd63ab2cc5f6da00adf5ebdee6

    • SSDEEP

      12288:e0RUzZDRJxRW2YjW4WsGs1l8i/8sCHcOtGrc:e0RUzN7R4WsGs78iFCh

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • AgentTesla payload

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks