Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    33ca8559428948c8807d92e92d833e6be360ccf985811fbea56ffe21361e5f0b

  • Size

    774KB

  • Sample

    230819-rr2jjaaf94

  • MD5

    598849ad3c499105d680f5aa169f7567

  • SHA1

    bbaa93c88d6bbb0f240da884574c72006f2dbe88

  • SHA256

    33ca8559428948c8807d92e92d833e6be360ccf985811fbea56ffe21361e5f0b

  • SHA512

    fca830bc48ac83ffe94cc70f1fd9bc210f6668e7a5218210c135eb0881f34ba673287843a6ae0b739bfa5ce545a5d2ae9c7dab8b53e38d9295f1d764edc92696

  • SSDEEP

    24576:myw7mmNEz3IxeaHPKnEz+4bNquwV8XKw08+AjDl:1omWED0vKnEz+4bNrwn8

Malware Config

Extracted

Family

amadey

Version

S-%lu-

C2

77.91.68.18/nice/index.php

3.87/nice/index.php

Extracted

Family

redline

Botnet

jonka

C2

77.91.124.73:19071

Attributes
  • auth_value

    c95bc30cd252fa6dff2a19fd78bfab4e

Targets

    • Target

      33ca8559428948c8807d92e92d833e6be360ccf985811fbea56ffe21361e5f0b

    • Size

      774KB

    • MD5

      598849ad3c499105d680f5aa169f7567

    • SHA1

      bbaa93c88d6bbb0f240da884574c72006f2dbe88

    • SHA256

      33ca8559428948c8807d92e92d833e6be360ccf985811fbea56ffe21361e5f0b

    • SHA512

      fca830bc48ac83ffe94cc70f1fd9bc210f6668e7a5218210c135eb0881f34ba673287843a6ae0b739bfa5ce545a5d2ae9c7dab8b53e38d9295f1d764edc92696

    • SSDEEP

      24576:myw7mmNEz3IxeaHPKnEz+4bNquwV8XKw08+AjDl:1omWED0vKnEz+4bNrwn8

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks