Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
JaffaCakes118_789373b7e8bfc21a2acccaaf4926590d
-
Size
402KB
-
Sample
250107-zmcnlsznbn
-
MD5
789373b7e8bfc21a2acccaaf4926590d
-
SHA1
62c13ed0d5ab860cec8981fed0cc34e8d85243c0
-
SHA256
1183feed064c66f5321e3d89c985542fcff19f29fb9f859fde262e7b2678cbca
-
SHA512
120d6eddc36bfd7d732c30b3cc1c737e90c0eebbd87feb456fbfe8df914c7feaf3e538b13e1637196b95f8e0951ecca95702b6b030a3cb0f788b1a64bdb8c7f4
-
SSDEEP
6144:9YF6GAORVTEcm/w9fiwFmG1OAV9I4GSbeBHwqEn2bqaU3xWYYJahywzG:9YMG319ibdAbNG4e5wmbq3hkvQG
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_789373b7e8bfc21a2acccaaf4926590d.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_789373b7e8bfc21a2acccaaf4926590d.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1990818097:AAEwom4DVSnyX5nLZhtvlrvCnmzUsVj23cE/sendDocument
Targets
-
-
Target
JaffaCakes118_789373b7e8bfc21a2acccaaf4926590d
-
Size
402KB
-
MD5
789373b7e8bfc21a2acccaaf4926590d
-
SHA1
62c13ed0d5ab860cec8981fed0cc34e8d85243c0
-
SHA256
1183feed064c66f5321e3d89c985542fcff19f29fb9f859fde262e7b2678cbca
-
SHA512
120d6eddc36bfd7d732c30b3cc1c737e90c0eebbd87feb456fbfe8df914c7feaf3e538b13e1637196b95f8e0951ecca95702b6b030a3cb0f788b1a64bdb8c7f4
-
SSDEEP
6144:9YF6GAORVTEcm/w9fiwFmG1OAV9I4GSbeBHwqEn2bqaU3xWYYJahywzG:9YMG319ibdAbNG4e5wmbq3hkvQG
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
AgentTesla payload
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1