Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    7d84e0aa0d09425ff3ef23d6a01dc8c8e709488dd4ebfb66d005d00c96b56636

  • Size

    936KB

  • Sample

    230903-qt6etsac4s

  • MD5

    cea83b418dd632977bc71493b6a7616a

  • SHA1

    f868454521eca497af6c4d7d05731d94c5402a69

  • SHA256

    7d84e0aa0d09425ff3ef23d6a01dc8c8e709488dd4ebfb66d005d00c96b56636

  • SHA512

    8e2e4d3136abbca50adbceac3f5e9c7f8e06262892ecd3e51908c3f1b2f827eec6b6b854a0737cac7bf09e28c25790d06ea0ed9b6fdd46057c9534cc8513827a

  • SSDEEP

    24576:ByVFL7CF8CLGT805b0777tO7U7zGcslxK:0VFL7CF8eMnl0JFhsl

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Attributes
  • install_dir

    b40d11255d

  • install_file

    saves.exe

  • strings_key

    fa622dfc42544927a6471829ee1fa9fe

rc4.plain

Extracted

Family

redline

Botnet

narik

C2

77.91.124.82:19071

Attributes
  • auth_value

    07924f5ef90576eb64faea857b8ba3e5

Targets

    • Target

      7d84e0aa0d09425ff3ef23d6a01dc8c8e709488dd4ebfb66d005d00c96b56636

    • Size

      936KB

    • MD5

      cea83b418dd632977bc71493b6a7616a

    • SHA1

      f868454521eca497af6c4d7d05731d94c5402a69

    • SHA256

      7d84e0aa0d09425ff3ef23d6a01dc8c8e709488dd4ebfb66d005d00c96b56636

    • SHA512

      8e2e4d3136abbca50adbceac3f5e9c7f8e06262892ecd3e51908c3f1b2f827eec6b6b854a0737cac7bf09e28c25790d06ea0ed9b6fdd46057c9534cc8513827a

    • SSDEEP

      24576:ByVFL7CF8CLGT805b0777tO7U7zGcslxK:0VFL7CF8eMnl0JFhsl

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks