Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    286b85293917baa446cf10e441368cb6.exe

  • Size

    359KB

  • Sample

    230805-fzt9msfh37

  • MD5

    286b85293917baa446cf10e441368cb6

  • SHA1

    74eda0e8d66f0ab4941471bcdc118a05a28d12c2

  • SHA256

    3bbf1d82a120c8a94ca841f456ac0dea56be3353b4d290ac82414ba7afa94d11

  • SHA512

    851ddaaa93691623da5ff60f6cc7a168be6e29ed30de888c85b930ad8c9323c9d7ce43ffd16927ab5caa2a5f78ce89fa1266b487b5e423865734d9190c519cf9

  • SSDEEP

    6144:K0y+bnr+Gp0yN90QEs1crFP+yxpdxkWGjZNR/tLLthSzyyi152AEagHXAWkia:AMrGy90+CxNOtPbSzFi152hHQfx

Malware Config

Extracted

Family

amadey

Version

3.86

C2

77.91.68.61/rock/index.php

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Targets

    • Target

      286b85293917baa446cf10e441368cb6.exe

    • Size

      359KB

    • MD5

      286b85293917baa446cf10e441368cb6

    • SHA1

      74eda0e8d66f0ab4941471bcdc118a05a28d12c2

    • SHA256

      3bbf1d82a120c8a94ca841f456ac0dea56be3353b4d290ac82414ba7afa94d11

    • SHA512

      851ddaaa93691623da5ff60f6cc7a168be6e29ed30de888c85b930ad8c9323c9d7ce43ffd16927ab5caa2a5f78ce89fa1266b487b5e423865734d9190c519cf9

    • SSDEEP

      6144:K0y+bnr+Gp0yN90QEs1crFP+yxpdxkWGjZNR/tLLthSzyyi152AEagHXAWkia:AMrGy90+CxNOtPbSzFi152hHQfx

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks