Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    399db71311fdd2917ad7eecda58fb6979c67235595ec0e65aff9877fbf3f78f7

  • Size

    514KB

  • Sample

    230718-e8sazagc86

  • MD5

    61675077a5002a48fd62232afb1090f6

  • SHA1

    8e3f3dd1298cfb00912d6dd97c36d18fea2771b5

  • SHA256

    399db71311fdd2917ad7eecda58fb6979c67235595ec0e65aff9877fbf3f78f7

  • SHA512

    4a69f9f16548b8d4ab299357b76331feb8ad434a1ef0479252fbe4567af23f656e7130ddb392309c442dad14f8d97d98f2eb1dd02b091c2dc1e7d0ca872a4703

  • SSDEEP

    12288:dMrsy90MAI4TD55s/s+LYKX5oTiZkM98uMNUH7DZf/:5yjAIpzLYq5oTiD8uMNUHPZf/

Malware Config

Extracted

Family

amadey

Version

3.85

C2

77.91.68.3/home/love/index.php

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
1
0x4b3b02b6
rc4.i32
1
0x6ea683ed

Extracted

Family

redline

Botnet

roma

C2

77.91.68.56:19071

Attributes
  • auth_value

    f099c2cf92834dbc554a94e1456cf576

Targets

    • Target

      399db71311fdd2917ad7eecda58fb6979c67235595ec0e65aff9877fbf3f78f7

    • Size

      514KB

    • MD5

      61675077a5002a48fd62232afb1090f6

    • SHA1

      8e3f3dd1298cfb00912d6dd97c36d18fea2771b5

    • SHA256

      399db71311fdd2917ad7eecda58fb6979c67235595ec0e65aff9877fbf3f78f7

    • SHA512

      4a69f9f16548b8d4ab299357b76331feb8ad434a1ef0479252fbe4567af23f656e7130ddb392309c442dad14f8d97d98f2eb1dd02b091c2dc1e7d0ca872a4703

    • SSDEEP

      12288:dMrsy90MAI4TD55s/s+LYKX5oTiZkM98uMNUH7DZf/:5yjAIpzLYq5oTiD8uMNUHPZf/

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.