Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    b9628685dc03866d8841270ded979a5e4d6162c391caf0b8220dc19a297c5087

  • Size

    293KB

  • Sample

    221029-fxpldacdd9

  • MD5

    3f0aa56d85079980c41c0f281579bc09

  • SHA1

    9eb62ae8fc632f866b34f19fd34d004917c09d2b

  • SHA256

    b9628685dc03866d8841270ded979a5e4d6162c391caf0b8220dc19a297c5087

  • SHA512

    eab3097f5541d9f11a09751dc45aca4a6d9f9bc8916e02c2cbc8226c654e165003198c5bfcff23a688d76852f3c548c05c62d41d770c3d917f5e4c2c358b6407

  • SSDEEP

    3072:Wf3qBUKQLf7w4Qz5mEux5QfDLCl5kOFx8s9zVUsDFuAw2R2PQ3bWopZ4LEbM/h3:iqBbQLDwKTQfdOAsbTzw26QTL4Lu

Malware Config

Targets

    • Target

      b9628685dc03866d8841270ded979a5e4d6162c391caf0b8220dc19a297c5087

    • Size

      293KB

    • MD5

      3f0aa56d85079980c41c0f281579bc09

    • SHA1

      9eb62ae8fc632f866b34f19fd34d004917c09d2b

    • SHA256

      b9628685dc03866d8841270ded979a5e4d6162c391caf0b8220dc19a297c5087

    • SHA512

      eab3097f5541d9f11a09751dc45aca4a6d9f9bc8916e02c2cbc8226c654e165003198c5bfcff23a688d76852f3c548c05c62d41d770c3d917f5e4c2c358b6407

    • SSDEEP

      3072:Wf3qBUKQLf7w4Qz5mEux5QfDLCl5kOFx8s9zVUsDFuAw2R2PQ3bWopZ4LEbM/h3:iqBbQLDwKTQfdOAsbTzw26QTL4Lu

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detect Amadey credential stealer module

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v6

Tasks