Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
66d03b788fb30b48ae88976c7f558f4da002665d2c493914addf9449126b9daa.exe
-
Size
605KB
-
Sample
250110-rxhzdaxjgv
-
MD5
c1724dddbf52cc09ecdae09749d97cfc
-
SHA1
8365d90f6a0acdaa5346d74d8d52b2f82a488625
-
SHA256
66d03b788fb30b48ae88976c7f558f4da002665d2c493914addf9449126b9daa
-
SHA512
4e6102405e7a857f8071a5678e3855bb4b09c75711df1becc8e7633cb5266b299940e9bbe6b780de180553f81339e22b73d34d443b5b4dc67ccb3f46812e42ff
-
SSDEEP
12288:squErHF6xC9D6DmR1J98w4oknqOOCyQf5gjnVfHWfiOn80lH8Myrw8il+f:9rl6kD68JmlotQfGVLOn8QKE8pf
Behavioral task
behavioral1
Sample
66d03b788fb30b48ae88976c7f558f4da002665d2c493914addf9449126b9daa.exe
Resource
win7-20240903-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.stingatoareincendii.ro - Port:
21 - Username:
[email protected] - Password:
3.*RYhlG)lkA
Targets
-
-
Target
66d03b788fb30b48ae88976c7f558f4da002665d2c493914addf9449126b9daa.exe
-
Size
605KB
-
MD5
c1724dddbf52cc09ecdae09749d97cfc
-
SHA1
8365d90f6a0acdaa5346d74d8d52b2f82a488625
-
SHA256
66d03b788fb30b48ae88976c7f558f4da002665d2c493914addf9449126b9daa
-
SHA512
4e6102405e7a857f8071a5678e3855bb4b09c75711df1becc8e7633cb5266b299940e9bbe6b780de180553f81339e22b73d34d443b5b4dc67ccb3f46812e42ff
-
SSDEEP
12288:squErHF6xC9D6DmR1J98w4oknqOOCyQf5gjnVfHWfiOn80lH8Myrw8il+f:9rl6kD68JmlotQfGVLOn8QKE8pf
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-