Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    66d03b788fb30b48ae88976c7f558f4da002665d2c493914addf9449126b9daa.exe

  • Size

    605KB

  • Sample

    250111-d6twcavkgp

  • MD5

    c1724dddbf52cc09ecdae09749d97cfc

  • SHA1

    8365d90f6a0acdaa5346d74d8d52b2f82a488625

  • SHA256

    66d03b788fb30b48ae88976c7f558f4da002665d2c493914addf9449126b9daa

  • SHA512

    4e6102405e7a857f8071a5678e3855bb4b09c75711df1becc8e7633cb5266b299940e9bbe6b780de180553f81339e22b73d34d443b5b4dc67ccb3f46812e42ff

  • SSDEEP

    12288:squErHF6xC9D6DmR1J98w4oknqOOCyQf5gjnVfHWfiOn80lH8Myrw8il+f:9rl6kD68JmlotQfGVLOn8QKE8pf

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.stingatoareincendii.ro
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    3.*RYhlG)lkA

Targets

    • Target

      66d03b788fb30b48ae88976c7f558f4da002665d2c493914addf9449126b9daa.exe

    • Size

      605KB

    • MD5

      c1724dddbf52cc09ecdae09749d97cfc

    • SHA1

      8365d90f6a0acdaa5346d74d8d52b2f82a488625

    • SHA256

      66d03b788fb30b48ae88976c7f558f4da002665d2c493914addf9449126b9daa

    • SHA512

      4e6102405e7a857f8071a5678e3855bb4b09c75711df1becc8e7633cb5266b299940e9bbe6b780de180553f81339e22b73d34d443b5b4dc67ccb3f46812e42ff

    • SSDEEP

      12288:squErHF6xC9D6DmR1J98w4oknqOOCyQf5gjnVfHWfiOn80lH8Myrw8il+f:9rl6kD68JmlotQfGVLOn8QKE8pf

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Agenttesla family

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks