Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
fff6aee69f42645920948783e24992100bf01af90d1d0c8a134e216d228a9fd7
-
Size
1.2MB
-
Sample
230418-h31lyaab63
-
MD5
a41f83d4c31fcdf2a079fc98605578c4
-
SHA1
c9d4466b6b60a20a80ff11f96d0cf63ebc63b181
-
SHA256
fff6aee69f42645920948783e24992100bf01af90d1d0c8a134e216d228a9fd7
-
SHA512
695fef2f85bff2e0d53fb1d5e262cc92d54f4bdf20609ae0080ae99f3eb84c00a08f5f915a87e4d85a8639a4e47c430eb6bcd2f2f9cee8884ed5e6b60070edb8
-
SSDEEP
24576:byvus8oWxnjIvGp05JKohZ98XXbVDkynO94f4eKWqGv3xW/:O3hWhAG25Jpf98XXbpQ4fKWTk
Static task
static1
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Targets
-
-
Target
fff6aee69f42645920948783e24992100bf01af90d1d0c8a134e216d228a9fd7
-
Size
1.2MB
-
MD5
a41f83d4c31fcdf2a079fc98605578c4
-
SHA1
c9d4466b6b60a20a80ff11f96d0cf63ebc63b181
-
SHA256
fff6aee69f42645920948783e24992100bf01af90d1d0c8a134e216d228a9fd7
-
SHA512
695fef2f85bff2e0d53fb1d5e262cc92d54f4bdf20609ae0080ae99f3eb84c00a08f5f915a87e4d85a8639a4e47c430eb6bcd2f2f9cee8884ed5e6b60070edb8
-
SSDEEP
24576:byvus8oWxnjIvGp05JKohZ98XXbVDkynO94f4eKWqGv3xW/:O3hWhAG25Jpf98XXbpQ4fKWTk
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-