Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    1f0161d9d0a69d47575ac67ca1f96e1dd93b8ab09ff987dc8739f8166001b3ae

  • Size

    1.2MB

  • Sample

    230503-m1lr8aed63

  • MD5

    b5c53933515d31bb4472657f98ae0734

  • SHA1

    ba62f5bafcfd60bdf9e5c4f8fa9fde6f83db1679

  • SHA256

    1f0161d9d0a69d47575ac67ca1f96e1dd93b8ab09ff987dc8739f8166001b3ae

  • SHA512

    088b9a8698973e2fa7959c4cd540b3a4d4651c73dbcb07028217d11c62fec749d7cc4b27811a9268135fb20c7f7e8c4a7340faecd392b4cbfa889ae4a01dc72a

  • SSDEEP

    24576:cyl5VtwSB4lS+TsNg3CB0HZotdT8rgKNJJ9Xpj56cn31TAzCoQLgTup6:LPgQ4vTseSBVar9NJTZj5b+JEgap

Malware Config

Extracted

Family

redline

Botnet

lupa

C2

217.196.96.56:4138

Attributes
  • auth_value

    fcb02fce9bc10c56a9841d56974bd7b8

Extracted

Family

redline

Botnet

boom

C2

217.196.96.56:4138

Attributes
  • auth_value

    1ce6aebe15bac07a7bc88b114bc49335

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Targets

    • Target

      1f0161d9d0a69d47575ac67ca1f96e1dd93b8ab09ff987dc8739f8166001b3ae

    • Size

      1.2MB

    • MD5

      b5c53933515d31bb4472657f98ae0734

    • SHA1

      ba62f5bafcfd60bdf9e5c4f8fa9fde6f83db1679

    • SHA256

      1f0161d9d0a69d47575ac67ca1f96e1dd93b8ab09ff987dc8739f8166001b3ae

    • SHA512

      088b9a8698973e2fa7959c4cd540b3a4d4651c73dbcb07028217d11c62fec749d7cc4b27811a9268135fb20c7f7e8c4a7340faecd392b4cbfa889ae4a01dc72a

    • SSDEEP

      24576:cyl5VtwSB4lS+TsNg3CB0HZotdT8rgKNJJ9Xpj56cn31TAzCoQLgTup6:LPgQ4vTseSBVar9NJTZj5b+JEgap

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks