Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    8f3e6c0c32b7345dc0565d97641721252ed25a4aa708e6a26b5fd6e5022e09b2

  • Size

    390KB

  • Sample

    230722-3gwfbacf94

  • MD5

    c867ab789c7cefc9a940acb56916159d

  • SHA1

    0313140f32c8aa292e8eb63d1226222eba50cb30

  • SHA256

    8f3e6c0c32b7345dc0565d97641721252ed25a4aa708e6a26b5fd6e5022e09b2

  • SHA512

    582509ef24f5a5b11d7e8697665bd2be73f7ec8ae4e86e2949790f82a5b990525adafb6931b5c3692960fd74c92d43becfd544135942711e98458b6f0ab90895

  • SSDEEP

    12288:iMrmy90Fl4+ArNYPWfQulPrQ1HcHnl98Rdj:4ywl4PNYPWIurQ18Ho/j

Malware Config

Extracted

Family

amadey

Version

3.85

C2

77.91.68.3/home/love/index.php

Extracted

Family

redline

Botnet

news

C2

77.91.68.68:19071

Attributes
  • auth_value

    99ba2ffe8d72ebe9fdc7e758c94db148

Targets

    • Target

      8f3e6c0c32b7345dc0565d97641721252ed25a4aa708e6a26b5fd6e5022e09b2

    • Size

      390KB

    • MD5

      c867ab789c7cefc9a940acb56916159d

    • SHA1

      0313140f32c8aa292e8eb63d1226222eba50cb30

    • SHA256

      8f3e6c0c32b7345dc0565d97641721252ed25a4aa708e6a26b5fd6e5022e09b2

    • SHA512

      582509ef24f5a5b11d7e8697665bd2be73f7ec8ae4e86e2949790f82a5b990525adafb6931b5c3692960fd74c92d43becfd544135942711e98458b6f0ab90895

    • SSDEEP

      12288:iMrmy90Fl4+ArNYPWfQulPrQ1HcHnl98Rdj:4ywl4PNYPWIurQ18Ho/j

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks