Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f250cfadd6c913c7ebd04fa37c564b2cd84f4a776eb99eef07c0f250678305ab

  • Size

    591KB

  • Sample

    230821-schzbafb8z

  • MD5

    c75775035719e57ed0c4e287b6e4bcae

  • SHA1

    84e2b442ec669efd89c517db0d3249ca2aecc0e7

  • SHA256

    f250cfadd6c913c7ebd04fa37c564b2cd84f4a776eb99eef07c0f250678305ab

  • SHA512

    c55ed261b137b0848cb47c55d643431e4bd845dca3189fa6dbe430461568ea115b293d8fd1aa01ec0d55521745d540864585f808bc6726c221b8881fbc243656

  • SSDEEP

    12288:nMray90q5kIBfjSeKTkIzyQflMozfvf9Xn82TuUG8CESdgCAT:xyn6e2oI+QNMozfdX8MuUGBES+T

Malware Config

Extracted

Family

amadey

Version

S-%lu-

C2

77.91.68.18/nice/index.php

3.87/nice/index.php

Extracted

Family

redline

Botnet

lang

C2

77.91.124.73:19071

Attributes
  • auth_value

    92c0fc2b7a8b3fc5a01baa1abf31c42a

Targets

    • Target

      f250cfadd6c913c7ebd04fa37c564b2cd84f4a776eb99eef07c0f250678305ab

    • Size

      591KB

    • MD5

      c75775035719e57ed0c4e287b6e4bcae

    • SHA1

      84e2b442ec669efd89c517db0d3249ca2aecc0e7

    • SHA256

      f250cfadd6c913c7ebd04fa37c564b2cd84f4a776eb99eef07c0f250678305ab

    • SHA512

      c55ed261b137b0848cb47c55d643431e4bd845dca3189fa6dbe430461568ea115b293d8fd1aa01ec0d55521745d540864585f808bc6726c221b8881fbc243656

    • SSDEEP

      12288:nMray90q5kIBfjSeKTkIzyQflMozfvf9Xn82TuUG8CESdgCAT:xyn6e2oI+QNMozfdX8MuUGBES+T

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks