Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
687e0533b04edaedd054b0563d6a2393fbd781824f5c464f616f1d6b942618c1
-
Size
633KB
-
Sample
230206-hv64rafh3w
-
MD5
4fe10b9a65172625b605aaecb88345b7
-
SHA1
41334080dbd88d9ef8ace07a76d2e36bddb7e391
-
SHA256
687e0533b04edaedd054b0563d6a2393fbd781824f5c464f616f1d6b942618c1
-
SHA512
18fcb7b0fef828e028be1734a3ec0f92313f46cfa575d04f5c37d1803fa23ae6ce5e433a57f5b7ff6a04526361bd694b1150c45894c3c6961a208e8f0c76cabb
-
SSDEEP
12288:7MrMy90WdcSJxnmU0vSqLmN5/uUGu+437msedIrLX0HjRjI:DyvxmUgyHhG343kdoYD2
Static task
static1
Malware Config
Extracted
amadey
3.66
62.204.41.5/Bu58Ngs/index.php
Targets
-
-
Target
687e0533b04edaedd054b0563d6a2393fbd781824f5c464f616f1d6b942618c1
-
Size
633KB
-
MD5
4fe10b9a65172625b605aaecb88345b7
-
SHA1
41334080dbd88d9ef8ace07a76d2e36bddb7e391
-
SHA256
687e0533b04edaedd054b0563d6a2393fbd781824f5c464f616f1d6b942618c1
-
SHA512
18fcb7b0fef828e028be1734a3ec0f92313f46cfa575d04f5c37d1803fa23ae6ce5e433a57f5b7ff6a04526361bd694b1150c45894c3c6961a208e8f0c76cabb
-
SSDEEP
12288:7MrMy90WdcSJxnmU0vSqLmN5/uUGu+437msedIrLX0HjRjI:DyvxmUgyHhG343kdoYD2
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-