Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1fa7003d9d894a0c00566b6e09f096cab98f2ce193a8d9f559c7fd07dade292c.bin
-
Size
1.1MB
-
Sample
230506-zn2zwsfe5w
-
MD5
981210792c9d44c3d91282861f788a19
-
SHA1
b826986782b558db6a91537726fcca1b65827db3
-
SHA256
1fa7003d9d894a0c00566b6e09f096cab98f2ce193a8d9f559c7fd07dade292c
-
SHA512
2c878363e7317e1da935f9d698a490eadd69abee424e8deec9b3787c878e90f472a9faebbf6dd405ea37d09f52df3633d41f9e9d9ec37ee18fd4eab2c9827e3f
-
SSDEEP
24576:ayh+gSh3ZUwzm3oLtRRjna1YqInSYBicEc5OPXNmL+adJ:h8gSvUwzmMt/KYDnSNc5OP9myO
Static task
static1
Behavioral task
behavioral1
Sample
1fa7003d9d894a0c00566b6e09f096cab98f2ce193a8d9f559c7fd07dade292c.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1fa7003d9d894a0c00566b6e09f096cab98f2ce193a8d9f559c7fd07dade292c.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Targets
-
-
Target
1fa7003d9d894a0c00566b6e09f096cab98f2ce193a8d9f559c7fd07dade292c.bin
-
Size
1.1MB
-
MD5
981210792c9d44c3d91282861f788a19
-
SHA1
b826986782b558db6a91537726fcca1b65827db3
-
SHA256
1fa7003d9d894a0c00566b6e09f096cab98f2ce193a8d9f559c7fd07dade292c
-
SHA512
2c878363e7317e1da935f9d698a490eadd69abee424e8deec9b3787c878e90f472a9faebbf6dd405ea37d09f52df3633d41f9e9d9ec37ee18fd4eab2c9827e3f
-
SSDEEP
24576:ayh+gSh3ZUwzm3oLtRRjna1YqInSYBicEc5OPXNmL+adJ:h8gSvUwzmMt/KYDnSNc5OP9myO
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-