Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

15800eefdf...4e.exe

windows7-x64

10

15800eefdf...4e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15800eefdfd1a8fece335d8a9ef4732188ba147f237d1159c23293a8e5a6ab4e

  • Size

    103KB

  • Sample

    231011-lwlqzsfa9v

  • MD5

    44d2b8fa70456ee06a72103b18409834

  • SHA1

    dde77bb13004c1d726e70b27e53580c6a02ebf84

  • SHA256

    5294ca11db1a451ea14ac98594233033ba1b45554f3bbfb8e60616b1509a2943

  • SHA512

    8f11e6c46ff7dbc9b334cf0a4e69d099116fd50c9f81b9fdab84d72e3f74a8c4867a1977a1856f6076253617da4142a2c2045ec03b00e740f12f0f17edad1f7e

  • SSDEEP

    3072:XLTzrHEDjomznpCacXyS+ZLRyy4c1m6J/Y:XLXmD8hX8ZNyCm6xY

Score
10/10
amadeytrojan

Malware Config

Extracted

Family

amadey

Version

3.89

C2

http://77.91.68.52/mac/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explonde.exe

  • strings_key

    916aae73606d7a9e02a1d3b47c199688

rc4.plain

Targets

    • Target

      15800eefdfd1a8fece335d8a9ef4732188ba147f237d1159c23293a8e5a6ab4e

    • Size

      240KB

    • MD5

      409c5cbf20f61015a81e831f58e487a4

    • SHA1

      12487a47f634366cc6208837dbd67473878f544e

    • SHA256

      15800eefdfd1a8fece335d8a9ef4732188ba147f237d1159c23293a8e5a6ab4e

    • SHA512

      4c28929e1febcf7f0a92c999a80f6c44241f7420b714feca8dc94796a28c2859d68a5a610bc96e42931d8b6d5c723ff6a0b66a00eff6ec0897d010d5df87cc90

    • SSDEEP

      6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2

    Score
    10/10
    amadeytrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks