Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    c144e57bd1d2d7d401b826d01a96daa3151dca77fefa5ccfa4c02d5330e1cd46

  • Size

    556KB

  • Sample

    230808-rkar8see7z

  • MD5

    4e98fb12bc651a07e5b8e2e6900767e7

  • SHA1

    d26974ccb7e3eb787d5dba1eaea1f419ed4777db

  • SHA256

    c144e57bd1d2d7d401b826d01a96daa3151dca77fefa5ccfa4c02d5330e1cd46

  • SHA512

    251d797c2e25398bb24201e83fbc9df2768196a2d736351baac8c285a8b950eab3d3b4d30c18149b5f7de1f2783fa187db97cf0d8391b67e63d066eb51b22335

  • SSDEEP

    12288:jMr2y90nQK2jF40JNfSIl8rGmNjzHQH/W3FHeGVRhJwH:Byk/uKkx/WxeGVP2H

Malware Config

Extracted

Family

amadey

Version

3.86

C2

77.91.68.61/rock/index.php

Extracted

Family

redline

Botnet

welos

C2

77.91.124.156:19071

Attributes
  • auth_value

    9605367dc0a1f64eb2f71769fb518fcf

Targets

    • Target

      c144e57bd1d2d7d401b826d01a96daa3151dca77fefa5ccfa4c02d5330e1cd46

    • Size

      556KB

    • MD5

      4e98fb12bc651a07e5b8e2e6900767e7

    • SHA1

      d26974ccb7e3eb787d5dba1eaea1f419ed4777db

    • SHA256

      c144e57bd1d2d7d401b826d01a96daa3151dca77fefa5ccfa4c02d5330e1cd46

    • SHA512

      251d797c2e25398bb24201e83fbc9df2768196a2d736351baac8c285a8b950eab3d3b4d30c18149b5f7de1f2783fa187db97cf0d8391b67e63d066eb51b22335

    • SSDEEP

      12288:jMr2y90nQK2jF40JNfSIl8rGmNjzHQH/W3FHeGVRhJwH:Byk/uKkx/WxeGVP2H

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.