Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6cexe_JC.exe

  • Size

    559KB

  • Sample

    230805-y4rnesfg9v

  • MD5

    547982741d54b65e813f3c41700f1ce0

  • SHA1

    28613a9e0cc8e9d727a4a576b044c208d6f9452b

  • SHA256

    79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6c

  • SHA512

    ab8786ec47349f5dad0146633a9e626e09593dd6ffbf0cbc8129a965d3b1c22099af936d1c3dd8a325bb4c192e70885f12c7993502129c0c9bdae326721179fd

  • SSDEEP

    12288:EMryy9038y4wtvqYUTIiifyKPsijjBw0Y7:myk8y4OmTIiify8s4jBwj7

Malware Config

Extracted

Family

amadey

Version

3.87

C2

193.233.255.9/nasa/index.php

Extracted

Family

redline

Botnet

maxik

C2

77.91.124.156:19071

Attributes
  • auth_value

    a7714e1bc167c67e3fc8f9e368352269

Targets

    • Target

      79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6cexe_JC.exe

    • Size

      559KB

    • MD5

      547982741d54b65e813f3c41700f1ce0

    • SHA1

      28613a9e0cc8e9d727a4a576b044c208d6f9452b

    • SHA256

      79d86b272c2a98c7d4266d85f6df0184cf201921ae1bc94005926d63b604ae6c

    • SHA512

      ab8786ec47349f5dad0146633a9e626e09593dd6ffbf0cbc8129a965d3b1c22099af936d1c3dd8a325bb4c192e70885f12c7993502129c0c9bdae326721179fd

    • SSDEEP

      12288:EMryy9038y4wtvqYUTIiifyKPsijjBw0Y7:myk8y4OmTIiify8s4jBwj7

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks