Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    10236e97c133b3f4251e183cd164d67e012f0c65c8815197db45b7bfabe09b34

  • Size

    756KB

  • Sample

    230819-z9xmasea3z

  • MD5

    f95def353d492ce71ab8ea99075a1769

  • SHA1

    f5c42c407758f44c68c071b658b6885293d315b6

  • SHA256

    10236e97c133b3f4251e183cd164d67e012f0c65c8815197db45b7bfabe09b34

  • SHA512

    68af335cfd47c6db94e3b8e866a6ec61484ff93cdba094e0968ebdef4f60136aca26da4d83a8e8ec610b9e1b17eae9e199eedb07e157c00e753594bcef98dfef

  • SSDEEP

    12288:cMrty90ExA687aesris4kcW+SFXbUeRueKBoO+HyqEpG8lk0h9UeindY7ZM0q:hylADaesyYFX4eceVHLEkAk07UxdYU

Malware Config

Extracted

Family

amadey

Version

S-%lu-

C2

77.91.68.18/nice/index.php

3.87/nice/index.php

Extracted

Family

redline

Botnet

jonka

C2

77.91.124.73:19071

Attributes
  • auth_value

    c95bc30cd252fa6dff2a19fd78bfab4e

Targets

    • Target

      10236e97c133b3f4251e183cd164d67e012f0c65c8815197db45b7bfabe09b34

    • Size

      756KB

    • MD5

      f95def353d492ce71ab8ea99075a1769

    • SHA1

      f5c42c407758f44c68c071b658b6885293d315b6

    • SHA256

      10236e97c133b3f4251e183cd164d67e012f0c65c8815197db45b7bfabe09b34

    • SHA512

      68af335cfd47c6db94e3b8e866a6ec61484ff93cdba094e0968ebdef4f60136aca26da4d83a8e8ec610b9e1b17eae9e199eedb07e157c00e753594bcef98dfef

    • SSDEEP

      12288:cMrty90ExA687aesris4kcW+SFXbUeRueKBoO+HyqEpG8lk0h9UeindY7ZM0q:hylADaesyYFX4eceVHLEkAk07UxdYU

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks