Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    85d19643e9593bde14c3c6e9b85c2a63b4547b23d47ee112553a5d34c44e0a75exe_JC.exe

  • Size

    555KB

  • Sample

    230806-nxqgnsbd2z

  • MD5

    3a436e89794587d2393f1d92979b9b4c

  • SHA1

    bdad04fa81d302adbabaae58e53d27dfa6cbba74

  • SHA256

    85d19643e9593bde14c3c6e9b85c2a63b4547b23d47ee112553a5d34c44e0a75

  • SHA512

    b75ffef6d05b711669d948ad2a9b869f5ba2e950bd9bd9f16a9b5c2c8d7efa8572e486232fece3819811b50994731dc168d4bfc4adcca226b129aea3f5216230

  • SSDEEP

    12288:TMruy90zuu27jaYxMdjjHlLBqhhiEDLGUUI9:9y197j5sjjHlLB419

Malware Config

Extracted

Family

amadey

Version

3.86

C2

77.91.68.61/rock/index.php

Extracted

Family

redline

Botnet

micky

C2

77.91.124.172:19071

Attributes
  • auth_value

    748f3c67c004f4a994500f05127b4428

Targets

    • Target

      85d19643e9593bde14c3c6e9b85c2a63b4547b23d47ee112553a5d34c44e0a75exe_JC.exe

    • Size

      555KB

    • MD5

      3a436e89794587d2393f1d92979b9b4c

    • SHA1

      bdad04fa81d302adbabaae58e53d27dfa6cbba74

    • SHA256

      85d19643e9593bde14c3c6e9b85c2a63b4547b23d47ee112553a5d34c44e0a75

    • SHA512

      b75ffef6d05b711669d948ad2a9b869f5ba2e950bd9bd9f16a9b5c2c8d7efa8572e486232fece3819811b50994731dc168d4bfc4adcca226b129aea3f5216230

    • SSDEEP

      12288:TMruy90zuu27jaYxMdjjHlLBqhhiEDLGUUI9:9y197j5sjjHlLB419

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks