Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    1fa7003d9d894a0c00566b6e09f096cab98f2ce193a8d9f559c7fd07dade292c.bin

  • Size

    1.1MB

  • Sample

    230506-zn2zwsfe5w

  • MD5

    981210792c9d44c3d91282861f788a19

  • SHA1

    b826986782b558db6a91537726fcca1b65827db3

  • SHA256

    1fa7003d9d894a0c00566b6e09f096cab98f2ce193a8d9f559c7fd07dade292c

  • SHA512

    2c878363e7317e1da935f9d698a490eadd69abee424e8deec9b3787c878e90f472a9faebbf6dd405ea37d09f52df3633d41f9e9d9ec37ee18fd4eab2c9827e3f

  • SSDEEP

    24576:ayh+gSh3ZUwzm3oLtRRjna1YqInSYBicEc5OPXNmL+adJ:h8gSvUwzmMt/KYDnSNc5OP9myO

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Targets

    • Target

      1fa7003d9d894a0c00566b6e09f096cab98f2ce193a8d9f559c7fd07dade292c.bin

    • Size

      1.1MB

    • MD5

      981210792c9d44c3d91282861f788a19

    • SHA1

      b826986782b558db6a91537726fcca1b65827db3

    • SHA256

      1fa7003d9d894a0c00566b6e09f096cab98f2ce193a8d9f559c7fd07dade292c

    • SHA512

      2c878363e7317e1da935f9d698a490eadd69abee424e8deec9b3787c878e90f472a9faebbf6dd405ea37d09f52df3633d41f9e9d9ec37ee18fd4eab2c9827e3f

    • SSDEEP

      24576:ayh+gSh3ZUwzm3oLtRRjna1YqInSYBicEc5OPXNmL+adJ:h8gSvUwzmMt/KYDnSNc5OP9myO

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks