Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    1d9f6351cdb2ce1ab1fa4147d42eef0b.exe

  • Size

    787KB

  • Sample

    230703-df6gfsee37

  • MD5

    1d9f6351cdb2ce1ab1fa4147d42eef0b

  • SHA1

    8d3fb153d3eca3aebe537405bd8a7a1390013fc7

  • SHA256

    01c94f115dc14cb92660c360d33cd8cae78116f49e2fc9ffae95957dbeab49e6

  • SHA512

    e44a06609528a16503258006ec1b485b5c9e34e4bd543ac444f71021cbbe84d4dfe24813b5ecd6c17b6354b25227821b6ac6624057a99ac9660fd9ff21457247

  • SSDEEP

    12288:s+wTpZuvQ2PBsXHZKZpwog5eOMU8+36/K4mcpnvNiEP7WZL4ATFX3e+GBeBmyH9:9wTpkxcC6oW16dmSvoEP7WZ/TFXKIme9

Malware Config

Extracted

Family

redline

Botnet

novak

C2

77.91.124.49:19073

Attributes
  • auth_value

    31966dcd1c6ca86e6e8b0a259f9d8ffd

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Extracted

Family

amadey

Version

3.84

C2

77.91.68.63/doma/net/index.php

Extracted

Family

redline

Botnet

andre

C2

77.91.124.49:19073

Attributes
  • auth_value

    8e5522dc6bdb7e288797bc46c2687b12

Targets

    • Target

      1d9f6351cdb2ce1ab1fa4147d42eef0b.exe

    • Size

      787KB

    • MD5

      1d9f6351cdb2ce1ab1fa4147d42eef0b

    • SHA1

      8d3fb153d3eca3aebe537405bd8a7a1390013fc7

    • SHA256

      01c94f115dc14cb92660c360d33cd8cae78116f49e2fc9ffae95957dbeab49e6

    • SHA512

      e44a06609528a16503258006ec1b485b5c9e34e4bd543ac444f71021cbbe84d4dfe24813b5ecd6c17b6354b25227821b6ac6624057a99ac9660fd9ff21457247

    • SSDEEP

      12288:s+wTpZuvQ2PBsXHZKZpwog5eOMU8+36/K4mcpnvNiEP7WZL4ATFX3e+GBeBmyH9:9wTpkxcC6oW16dmSvoEP7WZ/TFXKIme9

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Healer an antivirus disabler dropper

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks