Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    16499424f1c37c1f3c6c62be4ac35fbf.bin

  • Size

    469KB

  • Sample

    230211-bcv57sgg68

  • MD5

    ea0a2ae4b3b47a82defe6e7f283f4514

  • SHA1

    dfd0a9dafb054f83b91fb876d52afe8e371498b4

  • SHA256

    4ee145601828f1c706bd9c33d8d0ed9c7dc1413ead9fd11e0e29f61aa8ab36cf

  • SHA512

    a1b1c4ef21508c6aa822e429dce9a310369b309ba4344bfeb700a2350e072a4e2608f716c1b493e7d1102f9b8792a4fd7a55c0476d32e7b1e156a3f2ccd10792

  • SSDEEP

    12288:BVPuD4NLc/uw3O737Q5W1c8B9f3vLktGqnmm9H:bHNLc/uw3Odc8fvzemKH

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.4/Gol478Ns/index.php

Targets

    • Target

      670f6ecd6b0d21395476f2e2127575c406df7bdd11626b5d39ea76f70df28925.exe

    • Size

      519KB

    • MD5

      16499424f1c37c1f3c6c62be4ac35fbf

    • SHA1

      dbd2e1228bd22ab566e89a478964bedb5ce5d555

    • SHA256

      670f6ecd6b0d21395476f2e2127575c406df7bdd11626b5d39ea76f70df28925

    • SHA512

      c6e0f53c1a7ac5f31f99e68f77288eec78798bd8efd3984a71b64888509bcd59d90f4a74f57e47a120784fd4742237effbe734f70a4f939e03b7865486e35a84

    • SSDEEP

      12288:nMrVy908rGe/JhOFG1Ye3es2EFIj8qSf:OyFh7OFGCe3es280m

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks