Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_8a366641fd68e8e1f9a95c70b033e065

  • Size

    426KB

  • Sample

    250108-enffnstkdw

  • MD5

    8a366641fd68e8e1f9a95c70b033e065

  • SHA1

    77180d284883d44381d9e900c3b5dedde59a43bf

  • SHA256

    d74b6c8662bcd8d74ab69f4959f4cc7e0c9298860d7b782c4bc8a810cb411353

  • SHA512

    2e339e9f730cfec905ccc3e87fa8dbe1581a4e8ded269dfc1b36490f7c199e2754273733cd7fc5d5c8562c721c9b022e6f2051d5928869bfa5722d872e80eebb

  • SSDEEP

    12288:W3teyBc/VdiQtSBrtt8st0sXOzoy4mHVACKo:kPBcyWSZEqxe3D1ACx

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      DHL Receipt_AWB#2045829822.exe

    • Size

      543KB

    • MD5

      ef4965b918eaf2d304c6278bf64c8714

    • SHA1

      61177734335a54f472b2b5cecacd731e5e7de08c

    • SHA256

      b99967ce372dc403c15d04d922a3f2ad461f55fe634aa5f00938fa3ef8d5fc4d

    • SHA512

      48eb139ec3f6d591aa1a26ca2c10d7d95494920da61b4e3343f5eb4fa562e5572b210bcaf35f16be4ddf6fda7dce009712b6e9edd8de5b955e6fea0cdd1810c3

    • SSDEEP

      12288:RH4jWaUi2iN/i7ZCtVQe+FvqCM310YPGd1o+L53:RaUi1UAtVp+Fvqj31jPG7p

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • AgentTesla payload

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks