Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    40c02890c7c26fd6aca6802381185ae82f202b951cbbc4b50f06a65bed3f55d7

  • Size

    690KB

  • Sample

    230306-qw9v2ace82

  • MD5

    3059405d8377afded81057b5d50b51ef

  • SHA1

    6c17b755da0d93e71c685c11c42af5ef604d9704

  • SHA256

    40c02890c7c26fd6aca6802381185ae82f202b951cbbc4b50f06a65bed3f55d7

  • SHA512

    4c44da1023a142ac7c3a65fd14a2fbcce43d2d28d53bb476a20e222e5aba6a7388596d38b8b19a7b97f213a5dce6d8978cc03b7eca29dd04023db23e6f0ef020

  • SSDEEP

    12288:fMrWy90k4ZUVfBW5ZNmSmJYWnSikCPv7TG6UOQwprnZIYlXHGFF:pyAiVGt2kujJzpTZNlXGr

Malware Config

Extracted

Family

amadey

Version

3.68

C2

193.233.20.26/Do3m4Gor/index.php

Extracted

Family

redline

Botnet

fabio

C2

193.233.20.27:4123

Attributes
  • auth_value

    56b82736c3f56b13be8e64c87d2cf9e5

Targets

    • Target

      40c02890c7c26fd6aca6802381185ae82f202b951cbbc4b50f06a65bed3f55d7

    • Size

      690KB

    • MD5

      3059405d8377afded81057b5d50b51ef

    • SHA1

      6c17b755da0d93e71c685c11c42af5ef604d9704

    • SHA256

      40c02890c7c26fd6aca6802381185ae82f202b951cbbc4b50f06a65bed3f55d7

    • SHA512

      4c44da1023a142ac7c3a65fd14a2fbcce43d2d28d53bb476a20e222e5aba6a7388596d38b8b19a7b97f213a5dce6d8978cc03b7eca29dd04023db23e6f0ef020

    • SSDEEP

      12288:fMrWy90k4ZUVfBW5ZNmSmJYWnSikCPv7TG6UOQwprnZIYlXHGFF:pyAiVGt2kujJzpTZNlXGr

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.