Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    04db092c6ec169532bd2c7b63603606d93eaed93448c0d427fadbf312f693169

  • Size

    1.2MB

  • Sample

    230420-qxsm5scb5s

  • MD5

    f9ab58c5afd69c8ef1d630463fe1d9d6

  • SHA1

    d296c55953a0128172cd21208fa06aa0626b0c80

  • SHA256

    04db092c6ec169532bd2c7b63603606d93eaed93448c0d427fadbf312f693169

  • SHA512

    0106d5672e43e2b676fc0a5d465118efefe51cf3655c8fdbf4fe383d5fb6be7b3bedeb0861b1a0f2c98d2dc8ce9aab8aad664624184a9d6e887276f6abf03372

  • SSDEEP

    24576:ZyJTD5IaXAHpS8WJdMvDAnFznTW/ujNTBOJDdeCWDq1U:MJTNtXAVIFzny/uhTBKeCV

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Targets

    • Target

      04db092c6ec169532bd2c7b63603606d93eaed93448c0d427fadbf312f693169

    • Size

      1.2MB

    • MD5

      f9ab58c5afd69c8ef1d630463fe1d9d6

    • SHA1

      d296c55953a0128172cd21208fa06aa0626b0c80

    • SHA256

      04db092c6ec169532bd2c7b63603606d93eaed93448c0d427fadbf312f693169

    • SHA512

      0106d5672e43e2b676fc0a5d465118efefe51cf3655c8fdbf4fe383d5fb6be7b3bedeb0861b1a0f2c98d2dc8ce9aab8aad664624184a9d6e887276f6abf03372

    • SSDEEP

      24576:ZyJTD5IaXAHpS8WJdMvDAnFznTW/ujNTBOJDdeCWDq1U:MJTNtXAVIFzny/uhTBKeCV

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks