Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    370bf13636a1738e260f99feb6a4507a05859f72445071c31a9f8724300d60a4

  • Size

    1.2MB

  • Sample

    230420-gfv79shh6w

  • MD5

    a488220463f26523fa8765aa57390582

  • SHA1

    e53f8b82f31580dc20141784ee4e14608a03aac4

  • SHA256

    370bf13636a1738e260f99feb6a4507a05859f72445071c31a9f8724300d60a4

  • SHA512

    65baf891d73c99744e405fad2474ba40f786763e63fc2884a07e3308d74c2a2c215cdaeec8ae287c561971b3ee56d86ff90194f8838785cd50b27631d8fac85a

  • SSDEEP

    24576:SyMTSLrpx+3pP7oTBGTwmp61OnA04WFblVvtkM53qBgk0ppv1YT4jSZw8P:50Qs7uG8m61sA7WvgwwbSpvK42Zw8

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Targets

    • Target

      370bf13636a1738e260f99feb6a4507a05859f72445071c31a9f8724300d60a4

    • Size

      1.2MB

    • MD5

      a488220463f26523fa8765aa57390582

    • SHA1

      e53f8b82f31580dc20141784ee4e14608a03aac4

    • SHA256

      370bf13636a1738e260f99feb6a4507a05859f72445071c31a9f8724300d60a4

    • SHA512

      65baf891d73c99744e405fad2474ba40f786763e63fc2884a07e3308d74c2a2c215cdaeec8ae287c561971b3ee56d86ff90194f8838785cd50b27631d8fac85a

    • SSDEEP

      24576:SyMTSLrpx+3pP7oTBGTwmp61OnA04WFblVvtkM53qBgk0ppv1YT4jSZw8P:50Qs7uG8m61sA7WvgwwbSpvK42Zw8

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks