Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    b88d79c1f3d3d8b1770f2ab7d8e06c6b69422087759a004933616e73fac96e61

  • Size

    1007KB

  • Sample

    230403-ap4gnsdb51

  • MD5

    ed5236cdd2cf6233ba14473e13a1d827

  • SHA1

    8b124482ab18d429ccc1f095a2b2eab74cad7b3e

  • SHA256

    b88d79c1f3d3d8b1770f2ab7d8e06c6b69422087759a004933616e73fac96e61

  • SHA512

    b67407f6db0b76ed328824b48d9047effee1e036edd1f45afb34fbf6edd66f305df3465cc2da114c415575cbbf3d202d95ffd5d66c076af76e1a8bd91f27083e

  • SSDEEP

    24576:lyYIfgDGM1IOBu/APy5nNFtExApXZDwvtq3C9VBpZVbM:AYy9Ue/APWNFCxMXZ0X9VBfVb

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

nord

C2

176.113.115.145:4125

Attributes
  • auth_value

    ebb7d38cdbd7c83cf6363ef3feb3a530

Extracted

Family

amadey

Version

3.69

C2

193.233.20.29/games/category/index.php

Targets

    • Target

      b88d79c1f3d3d8b1770f2ab7d8e06c6b69422087759a004933616e73fac96e61

    • Size

      1007KB

    • MD5

      ed5236cdd2cf6233ba14473e13a1d827

    • SHA1

      8b124482ab18d429ccc1f095a2b2eab74cad7b3e

    • SHA256

      b88d79c1f3d3d8b1770f2ab7d8e06c6b69422087759a004933616e73fac96e61

    • SHA512

      b67407f6db0b76ed328824b48d9047effee1e036edd1f45afb34fbf6edd66f305df3465cc2da114c415575cbbf3d202d95ffd5d66c076af76e1a8bd91f27083e

    • SSDEEP

      24576:lyYIfgDGM1IOBu/APy5nNFtExApXZDwvtq3C9VBpZVbM:AYy9Ue/APWNFCxMXZ0X9VBfVb

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks