Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
c6337bf74cec12f6834577d516f35cff483ebf07dbcb28d2b61e8be051b491c3
-
Size
1.1MB
-
Sample
230419-18v8hsdg23
-
MD5
2ffd5dd603026028f55a87cb93a8d6f4
-
SHA1
2c82ed46ab2af9526109bc0d5896199d4df9a3d2
-
SHA256
c6337bf74cec12f6834577d516f35cff483ebf07dbcb28d2b61e8be051b491c3
-
SHA512
4b21e93d4a712e0fe40c61b9ba925571d273a303c1dd87ae7eb46ae06897336019d6da5892bf20cd5d6142f89bd29b0fd5afa98de62bb1d62fe64d31696acc15
-
SSDEEP
24576:oybsAMY6xJoB0QiDDq6klAHbPZ+5F2TjarBoeLCyjI:vH6sB6DDq6klUO2HZ
Static task
static1
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Targets
-
-
Target
c6337bf74cec12f6834577d516f35cff483ebf07dbcb28d2b61e8be051b491c3
-
Size
1.1MB
-
MD5
2ffd5dd603026028f55a87cb93a8d6f4
-
SHA1
2c82ed46ab2af9526109bc0d5896199d4df9a3d2
-
SHA256
c6337bf74cec12f6834577d516f35cff483ebf07dbcb28d2b61e8be051b491c3
-
SHA512
4b21e93d4a712e0fe40c61b9ba925571d273a303c1dd87ae7eb46ae06897336019d6da5892bf20cd5d6142f89bd29b0fd5afa98de62bb1d62fe64d31696acc15
-
SSDEEP
24576:oybsAMY6xJoB0QiDDq6klAHbPZ+5F2TjarBoeLCyjI:vH6sB6DDq6klUO2HZ
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-