Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    17b3f7876616f84a3cf127af19d26762c7bc99d61592df5afe5d43a7f236bc89

  • Size

    951KB

  • Sample

    230418-kqhxgaae23

  • MD5

    5f1f1ac86f4f0a39aa9cc37cf464a892

  • SHA1

    46e0ef9e46e29d0aa7601cd40e7ea11631e57d7a

  • SHA256

    17b3f7876616f84a3cf127af19d26762c7bc99d61592df5afe5d43a7f236bc89

  • SHA512

    6fce499b9433786c11efb25f75d89dcbbe54fe10c4a6bd75dc2c9b75bc7bb2732c343fcae7b523bed784641653e9060b58db97df2ef6fb6f78797e5f018fc5bc

  • SSDEEP

    24576:/yl7cRshGL+7wBf8xyFtyfjCq8A9xgXFouZ0x6IAd/U:KlWshw+7wBf8x0yLCqZ9xgXFvZDI6/

Malware Config

Targets

    • Target

      17b3f7876616f84a3cf127af19d26762c7bc99d61592df5afe5d43a7f236bc89

    • Size

      951KB

    • MD5

      5f1f1ac86f4f0a39aa9cc37cf464a892

    • SHA1

      46e0ef9e46e29d0aa7601cd40e7ea11631e57d7a

    • SHA256

      17b3f7876616f84a3cf127af19d26762c7bc99d61592df5afe5d43a7f236bc89

    • SHA512

      6fce499b9433786c11efb25f75d89dcbbe54fe10c4a6bd75dc2c9b75bc7bb2732c343fcae7b523bed784641653e9060b58db97df2ef6fb6f78797e5f018fc5bc

    • SSDEEP

      24576:/yl7cRshGL+7wBf8xyFtyfjCq8A9xgXFouZ0x6IAd/U:KlWshw+7wBf8x0yLCqZ9xgXFvZDI6/

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks