Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
5af50bc88db0acd6518c4c07df2e66972ed091b413c87ad32b19c2cde24426cf
-
Size
1.1MB
-
Sample
230415-zpnhwshc31
-
MD5
79da5f809a554c555e9692b7fb420932
-
SHA1
d46ffbf60e8f09da407ca40c0d0da92bc5f764a1
-
SHA256
5af50bc88db0acd6518c4c07df2e66972ed091b413c87ad32b19c2cde24426cf
-
SHA512
f401c280a98887589af1cf678c90d46d917c4917d23aebf82f828ef5708ea28ed1ac8e8c73803adb9fcd5f30a4a148b642ecdf9631ce81fd4e9d59195fc96ee9
-
SSDEEP
24576:hyCoQ7GwtkrpJ8Xh0zASB9cP6tI2ivwdvszT5uD34R9:UXQ7GwtkrUXCzAwc++y0zdu7
Static task
static1
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Targets
-
-
Target
5af50bc88db0acd6518c4c07df2e66972ed091b413c87ad32b19c2cde24426cf
-
Size
1.1MB
-
MD5
79da5f809a554c555e9692b7fb420932
-
SHA1
d46ffbf60e8f09da407ca40c0d0da92bc5f764a1
-
SHA256
5af50bc88db0acd6518c4c07df2e66972ed091b413c87ad32b19c2cde24426cf
-
SHA512
f401c280a98887589af1cf678c90d46d917c4917d23aebf82f828ef5708ea28ed1ac8e8c73803adb9fcd5f30a4a148b642ecdf9631ce81fd4e9d59195fc96ee9
-
SSDEEP
24576:hyCoQ7GwtkrpJ8Xh0zASB9cP6tI2ivwdvszT5uD34R9:UXQ7GwtkrUXCzAwc++y0zdu7
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-