Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    96e8d332007aff2e625f3c6c2a8722b169eaeab456951582755164187140a8e9

  • Size

    514KB

  • Sample

    230724-l1qwhacg3x

  • MD5

    074fa81629b9816b81085774490f382f

  • SHA1

    d815d43da4593341cafd4bdce71bb71496e32119

  • SHA256

    96e8d332007aff2e625f3c6c2a8722b169eaeab456951582755164187140a8e9

  • SHA512

    ccaec84fafeb15ce95ba5bd52d51a325a1b7a9871e486f2a9123ce256c0597bf299923c1d18193b4b476b90f4c20169715c5a87aef8c397d3c7f85fd76f342d5

  • SSDEEP

    12288:7MrOy90wmGCPl1xHsnXEO06tms385tk6jfETtT+m:5ysF1xqC6Ds5tk8cd

Malware Config

Extracted

Family

amadey

Version

3.85

C2

77.91.68.3/home/love/index.php

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

news

C2

77.91.68.68:19071

Attributes
  • auth_value

    99ba2ffe8d72ebe9fdc7e758c94db148

Targets

    • Target

      96e8d332007aff2e625f3c6c2a8722b169eaeab456951582755164187140a8e9

    • Size

      514KB

    • MD5

      074fa81629b9816b81085774490f382f

    • SHA1

      d815d43da4593341cafd4bdce71bb71496e32119

    • SHA256

      96e8d332007aff2e625f3c6c2a8722b169eaeab456951582755164187140a8e9

    • SHA512

      ccaec84fafeb15ce95ba5bd52d51a325a1b7a9871e486f2a9123ce256c0597bf299923c1d18193b4b476b90f4c20169715c5a87aef8c397d3c7f85fd76f342d5

    • SSDEEP

      12288:7MrOy90wmGCPl1xHsnXEO06tms385tk6jfETtT+m:5ysF1xqC6Ds5tk8cd

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks