Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    e68a4a202ae4bc8c19513046871ac1f0ee07000caa5deb6eff8ff6e638c52770

  • Size

    787KB

  • Sample

    230616-akwk9sbh77

  • MD5

    ba77f7500723c915acd6025b2eda5f34

  • SHA1

    67fc9a5a3aa68c7377f111e9e767244c875adda0

  • SHA256

    e68a4a202ae4bc8c19513046871ac1f0ee07000caa5deb6eff8ff6e638c52770

  • SHA512

    1279747dde48c1254729a3d5d049a48c0138ab047c6a2c272e1c3fb90db71119ae35536c0cb13c56a4fdc86d489b9509751236de1c905b2df38488d687fe1d51

  • SSDEEP

    12288:eMrJy90YJGj49tsWTGFiFySvtRswRbT4YUR42xfwE+4M40GeO8u+a3bH:zyG49qWzjDbT/UG20Gehu+cH

Malware Config

Extracted

Family

redline

Botnet

joker

C2

83.97.73.130:19061

Attributes
  • auth_value

    a98d303cc28bb3b32a23c59214ae3bc0

Extracted

Family

redline

Botnet

mana

C2

83.97.73.130:19061

Attributes
  • auth_value

    4f5139d6c845fe72d05faf05763b6c31

Extracted

Family

amadey

Version

3.84

C2

77.91.68.63/doma/net/index.php

Targets

    • Target

      e68a4a202ae4bc8c19513046871ac1f0ee07000caa5deb6eff8ff6e638c52770

    • Size

      787KB

    • MD5

      ba77f7500723c915acd6025b2eda5f34

    • SHA1

      67fc9a5a3aa68c7377f111e9e767244c875adda0

    • SHA256

      e68a4a202ae4bc8c19513046871ac1f0ee07000caa5deb6eff8ff6e638c52770

    • SHA512

      1279747dde48c1254729a3d5d049a48c0138ab047c6a2c272e1c3fb90db71119ae35536c0cb13c56a4fdc86d489b9509751236de1c905b2df38488d687fe1d51

    • SSDEEP

      12288:eMrJy90YJGj49tsWTGFiFySvtRswRbT4YUR42xfwE+4M40GeO8u+a3bH:zyG49qWzjDbT/UG20Gehu+cH

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks