Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_1f5fc6b5705f02547b22f321de7e246c

  • Size

    450KB

  • Sample

    250106-mymazaxjem

  • MD5

    1f5fc6b5705f02547b22f321de7e246c

  • SHA1

    5145b4acd60311d02630d0981c23699485ec58d0

  • SHA256

    f267d7b1aaf24adf016af932c069abebf8789bf864b56c9b9e81d51d8c3d23c2

  • SHA512

    58af42103606c48b67f55ebb2f70c66c0d2d2f25556aa118b657635bdcec2b22c7784e8ea4386074afa147fa7bd7fe94aae680e3c78e3ed5c1eae0d4b050ad68

  • SSDEEP

    12288:9dxin6lAe0wOqK7tWzWlJ+lhJOED0UkT8n1TxAf:3Y6lU7qCbJ+lWUn1TCf

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.sautiyapwanifm.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Uwada12345

Targets

    • Target

      JaffaCakes118_1f5fc6b5705f02547b22f321de7e246c

    • Size

      450KB

    • MD5

      1f5fc6b5705f02547b22f321de7e246c

    • SHA1

      5145b4acd60311d02630d0981c23699485ec58d0

    • SHA256

      f267d7b1aaf24adf016af932c069abebf8789bf864b56c9b9e81d51d8c3d23c2

    • SHA512

      58af42103606c48b67f55ebb2f70c66c0d2d2f25556aa118b657635bdcec2b22c7784e8ea4386074afa147fa7bd7fe94aae680e3c78e3ed5c1eae0d4b050ad68

    • SSDEEP

      12288:9dxin6lAe0wOqK7tWzWlJ+lhJOED0UkT8n1TxAf:3Y6lU7qCbJ+lWUn1TCf

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • AgentTesla payload

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks