Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    file.exe

  • Size

    332KB

  • Sample

    221103-byjpasgack

  • MD5

    e3dae8326bbf13e56a9c4664b5af6f1e

  • SHA1

    0d47847829b7f7f3eb2cc0cd7b60b74c14c90225

  • SHA256

    8249669b3c1bc3ad2e8d2884d72af15bc1a1fa850d45cd70a34a61031748dfe3

  • SHA512

    e7823a82f7b5c2e5cf9633664043aa02677d6b07de86b0f88fa6764f86b3810177a59d4b0a77d2b7903aadf39b1f53bfa88e68cc43bd588ad4eb3f1ff6d75869

  • SSDEEP

    3072:TSXCBPSmLj8FVtuk57b9dijkb8CzDnoskVwmIE7UmOaeVPQGj7urAB5IxPE/:2XCBHLIWmCE8CzDoskymUnaeVP5jBCc

Malware Config

Targets

    • Target

      file.exe

    • Size

      332KB

    • MD5

      e3dae8326bbf13e56a9c4664b5af6f1e

    • SHA1

      0d47847829b7f7f3eb2cc0cd7b60b74c14c90225

    • SHA256

      8249669b3c1bc3ad2e8d2884d72af15bc1a1fa850d45cd70a34a61031748dfe3

    • SHA512

      e7823a82f7b5c2e5cf9633664043aa02677d6b07de86b0f88fa6764f86b3810177a59d4b0a77d2b7903aadf39b1f53bfa88e68cc43bd588ad4eb3f1ff6d75869

    • SSDEEP

      3072:TSXCBPSmLj8FVtuk57b9dijkb8CzDnoskVwmIE7UmOaeVPQGj7urAB5IxPE/:2XCBHLIWmCE8CzDoskymUnaeVP5jBCc

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detect Amadey credential stealer module

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Accesses Microsoft Outlook profiles

MITRE ATT&CK Enterprise v6

Tasks