Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0x000600000001680a-52.dat

  • Size

    330KB

  • Sample

    230901-sjev8sff55

  • MD5

    db14bfcc5900e14fdee411b445e82121

  • SHA1

    8291e6a03ea20bf246b6f0527984a57abc598c0f

  • SHA256

    6a3d9ea12588b3ccd1ef8d56b6d24328f3c20c48e53fb87d2e248717cc10deb6

  • SHA512

    518300b4e36bcfe515bab00d8009eddd682ce529c514d49a1fa5581ed143d48b1a469ca37168999556a022d80cfe7a104fdb065641f3c9c83da2a97e8804ebfc

  • SSDEEP

    6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Attributes
  • install_dir

    b40d11255d

  • install_file

    saves.exe

  • strings_key

    fa622dfc42544927a6471829ee1fa9fe

rc4.plain

Targets

    • Target

      0x000600000001680a-52.dat

    • Size

      330KB

    • MD5

      db14bfcc5900e14fdee411b445e82121

    • SHA1

      8291e6a03ea20bf246b6f0527984a57abc598c0f

    • SHA256

      6a3d9ea12588b3ccd1ef8d56b6d24328f3c20c48e53fb87d2e248717cc10deb6

    • SHA512

      518300b4e36bcfe515bab00d8009eddd682ce529c514d49a1fa5581ed143d48b1a469ca37168999556a022d80cfe7a104fdb065641f3c9c83da2a97e8804ebfc

    • SSDEEP

      6144:SR9eh569+UR6P3zIwkp4p2k/DPaZHwc3eoe6u17MgAOIMs8Bq:Sfm5BB7kpi2k/ae6u17pa8Bq

    Score
    10/10
    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks