Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
04db092c6ec169532bd2c7b63603606d93eaed93448c0d427fadbf312f693169
-
Size
1.2MB
-
Sample
230420-qxsm5scb5s
-
MD5
f9ab58c5afd69c8ef1d630463fe1d9d6
-
SHA1
d296c55953a0128172cd21208fa06aa0626b0c80
-
SHA256
04db092c6ec169532bd2c7b63603606d93eaed93448c0d427fadbf312f693169
-
SHA512
0106d5672e43e2b676fc0a5d465118efefe51cf3655c8fdbf4fe383d5fb6be7b3bedeb0861b1a0f2c98d2dc8ce9aab8aad664624184a9d6e887276f6abf03372
-
SSDEEP
24576:ZyJTD5IaXAHpS8WJdMvDAnFznTW/ujNTBOJDdeCWDq1U:MJTNtXAVIFzny/uhTBKeCV
Static task
static1
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Targets
-
-
Target
04db092c6ec169532bd2c7b63603606d93eaed93448c0d427fadbf312f693169
-
Size
1.2MB
-
MD5
f9ab58c5afd69c8ef1d630463fe1d9d6
-
SHA1
d296c55953a0128172cd21208fa06aa0626b0c80
-
SHA256
04db092c6ec169532bd2c7b63603606d93eaed93448c0d427fadbf312f693169
-
SHA512
0106d5672e43e2b676fc0a5d465118efefe51cf3655c8fdbf4fe383d5fb6be7b3bedeb0861b1a0f2c98d2dc8ce9aab8aad664624184a9d6e887276f6abf03372
-
SSDEEP
24576:ZyJTD5IaXAHpS8WJdMvDAnFznTW/ujNTBOJDdeCWDq1U:MJTNtXAVIFzny/uhTBKeCV
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-