Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    61489fb28f59a778c7ac16f4d88c766cffffe2a153b8202115e6744e32e7641b

  • Size

    783KB

  • Sample

    241213-bj9l6stmgt

  • MD5

    220919d8e8a31db31e4efc371cae82a4

  • SHA1

    a87310ef3549cd609dc429a63bf45fde14ef4746

  • SHA256

    61489fb28f59a778c7ac16f4d88c766cffffe2a153b8202115e6744e32e7641b

  • SHA512

    3d60ab0f4f3101c0641da5a9a74fedd7bfd3b098d7feea5bbf2dc36eb11db321ea8bcd35c73dcdb602f0c46eea9183007ee5dd6582e77a4e293ffe712101f2df

  • SSDEEP

    24576:PjlIhSPd+p2O4qCfOVY5zL245CeYcaGqE7nReX:Pjl+SPspd45WVaSQzTacwX

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6050556352:AAE_-mublQ2CllMbT9xkQVBjSBbdvdYR1kM/

Targets

    • Target

      61489fb28f59a778c7ac16f4d88c766cffffe2a153b8202115e6744e32e7641b

    • Size

      783KB

    • MD5

      220919d8e8a31db31e4efc371cae82a4

    • SHA1

      a87310ef3549cd609dc429a63bf45fde14ef4746

    • SHA256

      61489fb28f59a778c7ac16f4d88c766cffffe2a153b8202115e6744e32e7641b

    • SHA512

      3d60ab0f4f3101c0641da5a9a74fedd7bfd3b098d7feea5bbf2dc36eb11db321ea8bcd35c73dcdb602f0c46eea9183007ee5dd6582e77a4e293ffe712101f2df

    • SSDEEP

      24576:PjlIhSPd+p2O4qCfOVY5zL245CeYcaGqE7nReX:Pjl+SPspd45WVaSQzTacwX

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks