Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    fb355965642d20a78b7a471b60f0d6e2ec1f6ed6ec3560665244c57a506cd38d.zip

  • Size

    586KB

  • Sample

    230308-nddnrsfc5z

  • MD5

    eccbaabe50fcdcb9e9dc8959785a073d

  • SHA1

    b43844347fedf1a5de1193b8f070e10d294604c8

  • SHA256

    9119cdd294b86695d3f246e74c198fab6cf89982928e50f92f414594b0a0a05c

  • SHA512

    67a4d53d47b39357d7dbf5ea532845b93f9415fffb6f0dbf1a06341f0c2e0dcb7c5487b4aaa2150f5776b2a4a977af20733ed9a6633a66770a32f1c85ef40e09

  • SSDEEP

    12288:7Wv+kRi8FIattem0BX/X0JKPDGxjCGj66ugKIRz8u37mptPIco:6RQ8WFBBvEEPDGxucnugPRz8a7mpZVo

Malware Config

Extracted

Family

redline

Botnet

garry

C2

193.56.146.11:4173

Attributes
  • auth_value

    210ba56bf751fefe327f26e00f0be5a9

Extracted

Family

amadey

Version

3.68

C2

193.56.146.218/images/IMG_489440/index.php

Targets

    • Target

      fb355965642d20a78b7a471b60f0d6e2ec1f6ed6ec3560665244c57a506cd38d.exe

    • Size

      653KB

    • MD5

      2b809d73b0b5062037119fd327fd5ab6

    • SHA1

      bfbd54086f2099beeadb22834f9d2cfa3505e2c4

    • SHA256

      fb355965642d20a78b7a471b60f0d6e2ec1f6ed6ec3560665244c57a506cd38d

    • SHA512

      d8b9b90abd2ca40536a9cfdd7c270819416c45c6894f29715914a85e5e9db935919e5c100e46e669a628e4d9f15d0066284fd92a858e32d762f015863a8766bc

    • SSDEEP

      12288:pJI3WClIN8y/AZYHhiY8HtjPFke4OGY2Z9dsGlt1yz58eJvBDb:pJI5q/0YHhGNjPFx4OGzvssteRJvtb

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks