Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    697d6039337903bd110fac305e9cdb5c0a26e5d4896fbf74e9e57a9e91ed80ba

  • Size

    704KB

  • Sample

    230829-kmeqmsbe38

  • MD5

    5703dc48335a283e25898a5a6d3fbda1

  • SHA1

    8281d1ec36cb6fb43e0b877ec341de4712762841

  • SHA256

    697d6039337903bd110fac305e9cdb5c0a26e5d4896fbf74e9e57a9e91ed80ba

  • SHA512

    52bc80bf6823943f607ab48fd4c775c68c527f19ab8ae031de1245bdd0498b4aca329e799e270e9aea527c82cc45d46adc1155cb3c74536b8aa5fbd82067aa6a

  • SSDEEP

    12288:DMrZy905vxTqUsk8ByFXxa1JH5ds+dHLHME70Pl+zh3h6cBAoK8CBCDG:SyIvxNssxa1JH5d4E70tEh19CBMG

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Extracted

Family

redline

Botnet

stas

C2

77.91.124.82:19071

Attributes
  • auth_value

    db6d96c4eade05afc28c31d9ad73a73c

Targets

    • Target

      697d6039337903bd110fac305e9cdb5c0a26e5d4896fbf74e9e57a9e91ed80ba

    • Size

      704KB

    • MD5

      5703dc48335a283e25898a5a6d3fbda1

    • SHA1

      8281d1ec36cb6fb43e0b877ec341de4712762841

    • SHA256

      697d6039337903bd110fac305e9cdb5c0a26e5d4896fbf74e9e57a9e91ed80ba

    • SHA512

      52bc80bf6823943f607ab48fd4c775c68c527f19ab8ae031de1245bdd0498b4aca329e799e270e9aea527c82cc45d46adc1155cb3c74536b8aa5fbd82067aa6a

    • SSDEEP

      12288:DMrZy905vxTqUsk8ByFXxa1JH5ds+dHLHME70Pl+zh3h6cBAoK8CBCDG:SyIvxNssxa1JH5d4E70tEh19CBMG

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks