Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0x00080000000122f6-1069.dat

  • Size

    226KB

  • Sample

    230325-eqtq3sba88

  • MD5

    b83d2ac2529a2a414c1e45c47cefcde5

  • SHA1

    e5759ba0f2af222c68d4bf6ee988e77d0b468934

  • SHA256

    40c31618efd6d6a2e8cdb543c4356ba4d9b7403e15d3ef9efa8ea0ef3b6408e9

  • SHA512

    b76fceffe3137ddd54318b48106911cf8c2bf0b8b1b9b3a0b1771dd6494261f2fe2530f8ddb1c2d4a71b76546eb172498eb339990a434011a667057627280570

  • SSDEEP

    6144:4rzyIG8IcCnD5A2QdY8rWpau1CYUqfhYdMBg:KmlLnD5qdY8Fu1CYUehrBg

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.68

C2

31.41.244.200/games/category/index.php

Targets

    • Target

      0x00080000000122f6-1069.dat

    • Size

      226KB

    • MD5

      b83d2ac2529a2a414c1e45c47cefcde5

    • SHA1

      e5759ba0f2af222c68d4bf6ee988e77d0b468934

    • SHA256

      40c31618efd6d6a2e8cdb543c4356ba4d9b7403e15d3ef9efa8ea0ef3b6408e9

    • SHA512

      b76fceffe3137ddd54318b48106911cf8c2bf0b8b1b9b3a0b1771dd6494261f2fe2530f8ddb1c2d4a71b76546eb172498eb339990a434011a667057627280570

    • SSDEEP

      6144:4rzyIG8IcCnD5A2QdY8rWpau1CYUqfhYdMBg:KmlLnD5qdY8Fu1CYUehrBg

    Score
    10/10
    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks