Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

398e8dc37c...3b.exe

windows7-x64

10

398e8dc37c...3b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    398e8dc37c03033944a48abd76ca8d2c01e12b87c7423162fbdd636e6fd5763b

  • Size

    1004KB

  • Sample

    250111-bng3qayqdm

  • MD5

    3a8d37c50db3290b1438b8e90eeeb159

  • SHA1

    d8701ba1d0761a06a700a5be37f8cf9faa6de790

  • SHA256

    398e8dc37c03033944a48abd76ca8d2c01e12b87c7423162fbdd636e6fd5763b

  • SHA512

    061a3e53429be97c836aaa420fad63ed107bb6354e881c03b2d01080c80c01393cd00c606165c49f62b403ddb4f615b9e61bbe4f746ea09257823d78cbe999b3

  • SSDEEP

    24576:Uu6J33O0c+JY5UZ+XC0kGsoTCcojZz7fINWY:uu0c++OCvkGsECcoJ7ftY

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://ftp.stingatoareincendii.ro
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    3.*RYhlG)lkA

Targets

    • Target

      398e8dc37c03033944a48abd76ca8d2c01e12b87c7423162fbdd636e6fd5763b

    • Size

      1004KB

    • MD5

      3a8d37c50db3290b1438b8e90eeeb159

    • SHA1

      d8701ba1d0761a06a700a5be37f8cf9faa6de790

    • SHA256

      398e8dc37c03033944a48abd76ca8d2c01e12b87c7423162fbdd636e6fd5763b

    • SHA512

      061a3e53429be97c836aaa420fad63ed107bb6354e881c03b2d01080c80c01393cd00c606165c49f62b403ddb4f615b9e61bbe4f746ea09257823d78cbe999b3

    • SSDEEP

      24576:Uu6J33O0c+JY5UZ+XC0kGsoTCcojZz7fINWY:uu0c++OCvkGsECcoJ7ftY

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Agenttesla family

      agenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks