Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ab579f97eb8b15e47d0989e7d039eb19.bin

  • Size

    473KB

  • Sample

    230211-b46q1sbd64

  • MD5

    f2e2d1a8d34133e85515f883fdc69b0d

  • SHA1

    7f417925f9d699242535addcbdc66cac9fc43f5d

  • SHA256

    6885aef8dfaf90c9e403844b6c707586c85b1e7fe625f8856aaa9e22d949267b

  • SHA512

    18451c8ed912c62bf469b06c67129ccf526aea115dfc526f5ac44858aa4e6c46ed2ba69d36bb86bfd53d3b02a7f85bdfc72d198bbe200f766ac2f0104d1cc6f8

  • SSDEEP

    12288:mczANrPWv6HUpFuzNTWzyL1XCtlaQkybhNH5Ax85Qr:xzKrPTU3uzNTmiXCtay+7r

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.4/Gol478Ns/index.php

Targets

    • Target

      00fb3bed3fd8fd8ea2b0963d6216575ffd85ef471b20b3242f21bd8c4f43b840.exe

    • Size

      523KB

    • MD5

      ab579f97eb8b15e47d0989e7d039eb19

    • SHA1

      e26f4af24520b7c2acc2dbe75bc5acfbe9fc0439

    • SHA256

      00fb3bed3fd8fd8ea2b0963d6216575ffd85ef471b20b3242f21bd8c4f43b840

    • SHA512

      e40aa44669dbbc009b7e962b6e379aa7a09bc3246fcb07f73f253fba7bdf6500c2429843aef227fa00834bedcf68aa3a98e4ebc2a604550cab112b7ee2cfb243

    • SSDEEP

      12288:JMrPy90jhF4kq+8LVjantUDbCBIl6bF+Viz6DnYpEvWbvs/EzlqermwLW:qyUh5zuVj+WHCihiUnYtYEtBLW

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks