Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de

  • Size

    724KB

  • Sample

    230215-gnyclaad97

  • MD5

    58fb8f1de6fd72b8bd70fec491c82d9f

  • SHA1

    57b94454411933ee426a92caccbda1d2ee1e7111

  • SHA256

    bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de

  • SHA512

    421732608584150c4c60e11fe6acaf950633bc9dc03fb18cae3487b480edee0814d38bab18b7d6c991c9388546bcd23d4a88fdd858a2b6368678bedff1ee3ba9

  • SSDEEP

    12288:aMrFy90sXdu5RCJEQ6iL43GguCicpvj59qtLS8sZo+ee83EqIvg:7yptxjL43FicBmo9ZoTe83ENI

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Extracted

Family

amadey

Version

3.66

C2

193.233.20.4/t6r48nSa/index.php

Targets

    • Target

      bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de

    • Size

      724KB

    • MD5

      58fb8f1de6fd72b8bd70fec491c82d9f

    • SHA1

      57b94454411933ee426a92caccbda1d2ee1e7111

    • SHA256

      bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de

    • SHA512

      421732608584150c4c60e11fe6acaf950633bc9dc03fb18cae3487b480edee0814d38bab18b7d6c991c9388546bcd23d4a88fdd858a2b6368678bedff1ee3ba9

    • SSDEEP

      12288:aMrFy90sXdu5RCJEQ6iL43GguCicpvj59qtLS8sZo+ee83EqIvg:7yptxjL43FicBmo9ZoTe83ENI

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks