Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5

  • Size

    390KB

  • Sample

    230719-e9agjsfg85

  • MD5

    737ec26180bc283aba28b78c2666f574

  • SHA1

    4206d28dc47498c37ca35e17731155d66acb5add

  • SHA256

    b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5

  • SHA512

    4798ed5797d27c4b06190969c1f1f18580668679d8dd2c34ee99d1794f168d6695d73f4ca755045b51916aef803b12bad999f5e37125e694625ad926db192e1f

  • SSDEEP

    12288:2Mrmy90qc8gh7R44+b3Qo+XggcHnl9R73e0Y0:kyrc/7OBAXgfHx3eS

Malware Config

Extracted

Family

amadey

Version

3.85

C2

77.91.68.3/home/love/index.php

Extracted

Family

redline

Botnet

roma

C2

77.91.68.56:19071

Attributes
  • auth_value

    f099c2cf92834dbc554a94e1456cf576

Targets

    • Target

      b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5

    • Size

      390KB

    • MD5

      737ec26180bc283aba28b78c2666f574

    • SHA1

      4206d28dc47498c37ca35e17731155d66acb5add

    • SHA256

      b0baeaac6ed2d7a174643421c41c1ae806fedc1002cadee9f8d22db8b261fae5

    • SHA512

      4798ed5797d27c4b06190969c1f1f18580668679d8dd2c34ee99d1794f168d6695d73f4ca755045b51916aef803b12bad999f5e37125e694625ad926db192e1f

    • SSDEEP

      12288:2Mrmy90qc8gh7R44+b3Qo+XggcHnl9R73e0Y0:kyrc/7OBAXgfHx3eS

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks