Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a280890ce5b841957f5a590584aa29b41e7bfa629ee14c048301dc2f855b9d2d

  • Size

    1.4MB

  • Sample

    230827-epsgmahc2x

  • MD5

    58abad0ec958c6eb12fd6226475f6100

  • SHA1

    e41d5c7a0b3d475f8bd34ca6c9565f723d919424

  • SHA256

    a280890ce5b841957f5a590584aa29b41e7bfa629ee14c048301dc2f855b9d2d

  • SHA512

    230c6cea395834d7b0c3cb19906a2240b72722934c6d7c06beb4d78e3af62bcd138eeb332ac14662f3c4ba6592829b50f89b420db2138a3b2409a92808f3a029

  • SSDEEP

    24576:RyDlK6kZNntywCvDVRqbxKM7Lo99QJiIFU8AhgkLvuIceCrZaM5IRG991671:ED7kZNOv/8KM7LkIL5kSxecZBeGR

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Extracted

Family

redline

Botnet

nrava

C2

77.91.124.82:19071

Attributes
  • auth_value

    43fe50e9ee6afb85588e03ac9676e2f7

Targets

    • Target

      a280890ce5b841957f5a590584aa29b41e7bfa629ee14c048301dc2f855b9d2d

    • Size

      1.4MB

    • MD5

      58abad0ec958c6eb12fd6226475f6100

    • SHA1

      e41d5c7a0b3d475f8bd34ca6c9565f723d919424

    • SHA256

      a280890ce5b841957f5a590584aa29b41e7bfa629ee14c048301dc2f855b9d2d

    • SHA512

      230c6cea395834d7b0c3cb19906a2240b72722934c6d7c06beb4d78e3af62bcd138eeb332ac14662f3c4ba6592829b50f89b420db2138a3b2409a92808f3a029

    • SSDEEP

      24576:RyDlK6kZNntywCvDVRqbxKM7Lo99QJiIFU8AhgkLvuIceCrZaM5IRG991671:ED7kZNOv/8KM7LkIL5kSxecZBeGR

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks