Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
14975df79b470ac44a7540f4cefb484ec13ddc6448b0365ef3fe9b75178d9c1a
-
Size
481KB
-
Sample
241125-bpcvdswlfn
-
MD5
09ed6786ab03235623dcd742eda52018
-
SHA1
d0d4fc22a0b51f44222edc4ecb05719f9520ffff
-
SHA256
14975df79b470ac44a7540f4cefb484ec13ddc6448b0365ef3fe9b75178d9c1a
-
SHA512
16b989ce6ef96063d8dd5513fa11d3ed729d2e0c5516057a929ded0d46f22690171833ec69dba1074b7253ce1e864264df788a240c3268c038cfe573888b83b6
-
SSDEEP
12288:DUi2iNrbPqdu30e9O6GAyCXYSwoT+VpqOB6Uu:DUi1VbPqA3x86jOBdu
Static task
static1
Behavioral task
behavioral1
Sample
14975df79b470ac44a7540f4cefb484ec13ddc6448b0365ef3fe9b75178d9c1a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
14975df79b470ac44a7540f4cefb484ec13ddc6448b0365ef3fe9b75178d9c1a.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
Ablegod123456
Targets
-
-
Target
14975df79b470ac44a7540f4cefb484ec13ddc6448b0365ef3fe9b75178d9c1a
-
Size
481KB
-
MD5
09ed6786ab03235623dcd742eda52018
-
SHA1
d0d4fc22a0b51f44222edc4ecb05719f9520ffff
-
SHA256
14975df79b470ac44a7540f4cefb484ec13ddc6448b0365ef3fe9b75178d9c1a
-
SHA512
16b989ce6ef96063d8dd5513fa11d3ed729d2e0c5516057a929ded0d46f22690171833ec69dba1074b7253ce1e864264df788a240c3268c038cfe573888b83b6
-
SSDEEP
12288:DUi2iNrbPqdu30e9O6GAyCXYSwoT+VpqOB6Uu:DUi1VbPqA3x86jOBdu
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
AgentTesla payload
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-