Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    644b7cb3aed3de4778e7a065b50051ecbe7804e682921f676816977729d3740c

  • Size

    1.1MB

  • Sample

    231012-er7dkaea7v

  • MD5

    07ce079b8fecf92910244fd9abb141bf

  • SHA1

    ea81a2f481e220d90550d8fdd9e0d2f5f2308174

  • SHA256

    644b7cb3aed3de4778e7a065b50051ecbe7804e682921f676816977729d3740c

  • SHA512

    56b6930e5a4289d8c0ade59820ee3806dd664262e7b38c67322db4c21775430ccc2a801457a662f04eb967ecefd65d068f723c36f18dedf4292b05125cad32e0

  • SSDEEP

    24576:DyiVhJOogVOl8vqT0yYy3PWQHqiLdRax0YOcxxUJ6GctWZ1fqja7:WUCj40y3fWaPd+0YOeoMwX0

Malware Config

Extracted

Family

redline

Botnet

trush

C2

77.91.124.82:19071

Attributes
  • auth_value

    c13814867cde8193679cd0cad2d774be

Extracted

Family

amadey

Version

3.89

C2

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explonde.exe

  • strings_key

    916aae73606d7a9e02a1d3b47c199688

rc4.plain
rc4.plain

Targets

    • Target

      644b7cb3aed3de4778e7a065b50051ecbe7804e682921f676816977729d3740c

    • Size

      1.1MB

    • MD5

      07ce079b8fecf92910244fd9abb141bf

    • SHA1

      ea81a2f481e220d90550d8fdd9e0d2f5f2308174

    • SHA256

      644b7cb3aed3de4778e7a065b50051ecbe7804e682921f676816977729d3740c

    • SHA512

      56b6930e5a4289d8c0ade59820ee3806dd664262e7b38c67322db4c21775430ccc2a801457a662f04eb967ecefd65d068f723c36f18dedf4292b05125cad32e0

    • SSDEEP

      24576:DyiVhJOogVOl8vqT0yYy3PWQHqiLdRax0YOcxxUJ6GctWZ1fqja7:WUCj40y3fWaPd+0YOeoMwX0

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks