Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    08230b01834cd97b7ca1025fd1307a02.exe

  • Size

    219KB

  • Sample

    231010-2fynlsfg21

  • MD5

    08230b01834cd97b7ca1025fd1307a02

  • SHA1

    ce63edae54e4b9239241683140fc30f4d0c652b5

  • SHA256

    0385cb1d807663acfb195e6dec3dcf4d76d47e60b130f007d2577c2e0ac91210

  • SHA512

    532b7e4bd4b68a974757e4c33f2ba0d01fcc52db2c01f569e67d0225d31090dee81b25f8106017387658f94d2d6c741d9e77b45ca18750ec06f2e114cba3a485

  • SSDEEP

    6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS

Score
10/10

Malware Config

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain

Targets

    • Target

      08230b01834cd97b7ca1025fd1307a02.exe

    • Size

      219KB

    • MD5

      08230b01834cd97b7ca1025fd1307a02

    • SHA1

      ce63edae54e4b9239241683140fc30f4d0c652b5

    • SHA256

      0385cb1d807663acfb195e6dec3dcf4d76d47e60b130f007d2577c2e0ac91210

    • SHA512

      532b7e4bd4b68a974757e4c33f2ba0d01fcc52db2c01f569e67d0225d31090dee81b25f8106017387658f94d2d6c741d9e77b45ca18750ec06f2e114cba3a485

    • SSDEEP

      6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS

    Score
    10/10
    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks