Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    file.exe

  • Size

    566KB

  • Sample

    230209-et8peabf72

  • MD5

    a3c06eb5ecb4ead73e61c1ede40904e6

  • SHA1

    96c4c7f16957d2434ab0e6db1401ed3044e66a1c

  • SHA256

    0009a3ca74a8aecddfd34261d7e14b076347e85edf2a0a6e5d9cd760d5eedbea

  • SHA512

    ce152282bae5423bd07798065088dd103a93f016005c52eb92f5e65c183c6828cd98d3dea64088c58f9c30d16b71a81522ac7a4b3e00dae1c57b6a402cadb389

  • SSDEEP

    12288:eMrdy90+iTP73fuQk/MrDptLH6iIDGCRDuMR015dyQpEeE:DyfmP73fkMrDXH6eS41uQS

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.4/Gol478Ns/index.php

Targets

    • Target

      file.exe

    • Size

      566KB

    • MD5

      a3c06eb5ecb4ead73e61c1ede40904e6

    • SHA1

      96c4c7f16957d2434ab0e6db1401ed3044e66a1c

    • SHA256

      0009a3ca74a8aecddfd34261d7e14b076347e85edf2a0a6e5d9cd760d5eedbea

    • SHA512

      ce152282bae5423bd07798065088dd103a93f016005c52eb92f5e65c183c6828cd98d3dea64088c58f9c30d16b71a81522ac7a4b3e00dae1c57b6a402cadb389

    • SSDEEP

      12288:eMrdy90+iTP73fuQk/MrDptLH6iIDGCRDuMR015dyQpEeE:DyfmP73fkMrDXH6eS41uQS

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks