Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    6dea68022ac1865157082d6490fc038bda7585ab31329fd6bdd3b554854a6fae

  • Size

    530KB

  • Sample

    241125-bn94hazphz

  • MD5

    0841c2069574298555b6fc6a6b650318

  • SHA1

    9594c397737cf58dda9a442db8940cb7771c6c4e

  • SHA256

    6dea68022ac1865157082d6490fc038bda7585ab31329fd6bdd3b554854a6fae

  • SHA512

    7713dfd123e3406a8edd2e8070eead65c6a6b7d456737783bd0c2ac7ada0b590bb820ffa2cde0122e80f69330cfe3dd7eb4ab0aac638c079a3b3c38aa17664bd

  • SSDEEP

    6144:sGxhLqIj0vvROK1cCu+mTKZ4NYrY0WWIx+L766MrREfaA3T6FemuszQxbbEakca4:FVwZTjuf+Z4T06x0766M/AD0emk5fa5O

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.jiemeimoulds.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    solution2527937

Targets

    • Target

      6dea68022ac1865157082d6490fc038bda7585ab31329fd6bdd3b554854a6fae

    • Size

      530KB

    • MD5

      0841c2069574298555b6fc6a6b650318

    • SHA1

      9594c397737cf58dda9a442db8940cb7771c6c4e

    • SHA256

      6dea68022ac1865157082d6490fc038bda7585ab31329fd6bdd3b554854a6fae

    • SHA512

      7713dfd123e3406a8edd2e8070eead65c6a6b7d456737783bd0c2ac7ada0b590bb820ffa2cde0122e80f69330cfe3dd7eb4ab0aac638c079a3b3c38aa17664bd

    • SSDEEP

      6144:sGxhLqIj0vvROK1cCu+mTKZ4NYrY0WWIx+L766MrREfaA3T6FemuszQxbbEakca4:FVwZTjuf+Z4T06x0766M/AD0emk5fa5O

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • AgentTesla payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks