Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    493823dfb095889113527c9e670849b13d215f20752093d177966fcf8103edf4

  • Size

    591KB

  • Sample

    230821-prhqbaee5z

  • MD5

    97a9fb073fa5ee804e1523d04cd3605e

  • SHA1

    c26a6ea11519edfe0ac1af47588972d14b9a31b9

  • SHA256

    493823dfb095889113527c9e670849b13d215f20752093d177966fcf8103edf4

  • SHA512

    c0638b6e81050881671e597de3989f1b6e08e9f91540d5bf0066ed5be553ab81ccadbaf76ce2f04c7b1055068af44934817b38f0100c226504ce70f3dfc8fe76

  • SSDEEP

    12288:qMrey90XMeKvXWXHybcMnykresuyypiMN9YAdJnH:wy0MxXWXHSyk6srMJnH

Malware Config

Extracted

Family

amadey

Version

S-%lu-

C2

77.91.68.18/nice/index.php

3.87/nice/index.php

Extracted

Family

redline

Botnet

lang

C2

77.91.124.73:19071

Attributes
  • auth_value

    92c0fc2b7a8b3fc5a01baa1abf31c42a

Targets

    • Target

      493823dfb095889113527c9e670849b13d215f20752093d177966fcf8103edf4

    • Size

      591KB

    • MD5

      97a9fb073fa5ee804e1523d04cd3605e

    • SHA1

      c26a6ea11519edfe0ac1af47588972d14b9a31b9

    • SHA256

      493823dfb095889113527c9e670849b13d215f20752093d177966fcf8103edf4

    • SHA512

      c0638b6e81050881671e597de3989f1b6e08e9f91540d5bf0066ed5be553ab81ccadbaf76ce2f04c7b1055068af44934817b38f0100c226504ce70f3dfc8fe76

    • SSDEEP

      12288:qMrey90XMeKvXWXHybcMnykresuyypiMN9YAdJnH:wy0MxXWXHSyk6srMJnH

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks