Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    48c634a386cef1760cc25fd46e4b42e94d3f48754f0711c573384c7af786d13d

  • Size

    704KB

  • Sample

    230823-ypdg9afc27

  • MD5

    41e0df44861db485fe4bfd5a4afa6191

  • SHA1

    a2125ec84fe54a8b8cf6d92d2563bedf63e7679c

  • SHA256

    48c634a386cef1760cc25fd46e4b42e94d3f48754f0711c573384c7af786d13d

  • SHA512

    59d54ddda53cc7dd73fabacb12e952db39acb1d4cca9e02016b666164df02b840ffca9825daa2f612c22e7e23b163a6856f247d310f9b547c3a4b21bc61328f1

  • SSDEEP

    12288:sMrfy90OM5P05xb/L4lq716Sd70fekpB7ov6kOoTpGmq86dabCZk/TSgb:7yq05V4lY3hNO9C6kBTpw8caBmi

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Extracted

Family

redline

Botnet

gogi

C2

77.91.124.73:19071

Attributes
  • auth_value

    c7dbabcf1eff128a595c7532cb5489a8

Targets

    • Target

      48c634a386cef1760cc25fd46e4b42e94d3f48754f0711c573384c7af786d13d

    • Size

      704KB

    • MD5

      41e0df44861db485fe4bfd5a4afa6191

    • SHA1

      a2125ec84fe54a8b8cf6d92d2563bedf63e7679c

    • SHA256

      48c634a386cef1760cc25fd46e4b42e94d3f48754f0711c573384c7af786d13d

    • SHA512

      59d54ddda53cc7dd73fabacb12e952db39acb1d4cca9e02016b666164df02b840ffca9825daa2f612c22e7e23b163a6856f247d310f9b547c3a4b21bc61328f1

    • SSDEEP

      12288:sMrfy90OM5P05xb/L4lq716Sd70fekpB7ov6kOoTpGmq86dabCZk/TSgb:7yq05V4lY3hNO9C6kBTpw8caBmi

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks