Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    5af50bc88db0acd6518c4c07df2e66972ed091b413c87ad32b19c2cde24426cf

  • Size

    1.1MB

  • Sample

    230415-zpnhwshc31

  • MD5

    79da5f809a554c555e9692b7fb420932

  • SHA1

    d46ffbf60e8f09da407ca40c0d0da92bc5f764a1

  • SHA256

    5af50bc88db0acd6518c4c07df2e66972ed091b413c87ad32b19c2cde24426cf

  • SHA512

    f401c280a98887589af1cf678c90d46d917c4917d23aebf82f828ef5708ea28ed1ac8e8c73803adb9fcd5f30a4a148b642ecdf9631ce81fd4e9d59195fc96ee9

  • SSDEEP

    24576:hyCoQ7GwtkrpJ8Xh0zASB9cP6tI2ivwdvszT5uD34R9:UXQ7GwtkrUXCzAwc++y0zdu7

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Targets

    • Target

      5af50bc88db0acd6518c4c07df2e66972ed091b413c87ad32b19c2cde24426cf

    • Size

      1.1MB

    • MD5

      79da5f809a554c555e9692b7fb420932

    • SHA1

      d46ffbf60e8f09da407ca40c0d0da92bc5f764a1

    • SHA256

      5af50bc88db0acd6518c4c07df2e66972ed091b413c87ad32b19c2cde24426cf

    • SHA512

      f401c280a98887589af1cf678c90d46d917c4917d23aebf82f828ef5708ea28ed1ac8e8c73803adb9fcd5f30a4a148b642ecdf9631ce81fd4e9d59195fc96ee9

    • SSDEEP

      24576:hyCoQ7GwtkrpJ8Xh0zASB9cP6tI2ivwdvszT5uD34R9:UXQ7GwtkrUXCzAwc++y0zdu7

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks