Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d

  • Size

    591KB

  • Sample

    230822-kbkshsba93

  • MD5

    e008139c1ea96bf93210e24a15736dcb

  • SHA1

    49e7f45542c40c686223cb3cb6081a4a71394970

  • SHA256

    948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d

  • SHA512

    04f201142a50d71e97a593cf17d72ca58ecae166f949455983a02e07b0f5bf5426a3e78b01e15006980abccabc3833d9e7d7ba41c2067f59647cbf411114ae36

  • SSDEEP

    12288:2MrTy90nHDBqPDBL0PPCkNtVHzQR7TaXOlR60hgGwBod:1y+jBqrSBdz4mXOl6G1

Malware Config

Extracted

Family

amadey

Version

S-%lu-

C2

77.91.68.18/nice/index.php

3.87/nice/index.php

Extracted

Family

redline

Botnet

piter

C2

77.91.124.73:19071

Attributes
  • auth_value

    7f92ff466423bb35edbfbc22f78b0bb9

Targets

    • Target

      948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d

    • Size

      591KB

    • MD5

      e008139c1ea96bf93210e24a15736dcb

    • SHA1

      49e7f45542c40c686223cb3cb6081a4a71394970

    • SHA256

      948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d

    • SHA512

      04f201142a50d71e97a593cf17d72ca58ecae166f949455983a02e07b0f5bf5426a3e78b01e15006980abccabc3833d9e7d7ba41c2067f59647cbf411114ae36

    • SSDEEP

      12288:2MrTy90nHDBqPDBL0PPCkNtVHzQR7TaXOlR60hgGwBod:1y+jBqrSBdz4mXOl6G1

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks