Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    bf3ff81e481f102d6d52362b94bba0dfba85ad3120dbe3d3699ec2a3817bfdf7

  • Size

    515KB

  • Sample

    230723-ygbzfsgc78

  • MD5

    47e24b2c00a90906f5c759470dd3b281

  • SHA1

    84220c39a159f0dda02b2e577697fd42a6eae411

  • SHA256

    bf3ff81e481f102d6d52362b94bba0dfba85ad3120dbe3d3699ec2a3817bfdf7

  • SHA512

    8209bcc41bacb7447c533c560e7ae930baa1f3dac52c142ca4e366264857b1e37068946c8b23f3032a542858908c57796cba94b08be480442521820ae534f3e3

  • SSDEEP

    12288:fMroy90AM9Ulw2Ig57GHm6Nz4SCMWN20do:ny/M9eEPcM0do

Malware Config

Extracted

Family

amadey

Version

3.85

C2

77.91.68.3/home/love/index.php

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

news

C2

77.91.68.68:19071

Attributes
  • auth_value

    99ba2ffe8d72ebe9fdc7e758c94db148

Targets

    • Target

      bf3ff81e481f102d6d52362b94bba0dfba85ad3120dbe3d3699ec2a3817bfdf7

    • Size

      515KB

    • MD5

      47e24b2c00a90906f5c759470dd3b281

    • SHA1

      84220c39a159f0dda02b2e577697fd42a6eae411

    • SHA256

      bf3ff81e481f102d6d52362b94bba0dfba85ad3120dbe3d3699ec2a3817bfdf7

    • SHA512

      8209bcc41bacb7447c533c560e7ae930baa1f3dac52c142ca4e366264857b1e37068946c8b23f3032a542858908c57796cba94b08be480442521820ae534f3e3

    • SSDEEP

      12288:fMroy90AM9Ulw2Ig57GHm6Nz4SCMWN20do:ny/M9eEPcM0do

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks