Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    7696bebd150e44a9654f6967786b9aea25da55de933d2355f64b804620d8d16e

  • Size

    1.1MB

  • Sample

    231012-hh5edsef29

  • MD5

    25bf2c82e23392efb173fb9725062f56

  • SHA1

    cb3603fe653cc538c8accfd51acea453be8405b1

  • SHA256

    7696bebd150e44a9654f6967786b9aea25da55de933d2355f64b804620d8d16e

  • SHA512

    fc58c5838ee581adcacc3cacc6697ae63aa001e34cfa2a269bdcba75f4fbd36f17c02149ba39e6d4c275b7f0e07edd1d61ab73a3b6894e2ca130f18b4446f9df

  • SSDEEP

    24576:6yW2TNKlLzmhM08em3kSbTgUPPk2pCAW6rwrdPd3Ikf6bzJn:BW2UZ010D8mbWZ7Ydb

Malware Config

Extracted

Family

redline

Botnet

trush

C2

77.91.124.82:19071

Attributes
  • auth_value

    c13814867cde8193679cd0cad2d774be

Extracted

Family

amadey

Version

3.89

C2

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explonde.exe

  • strings_key

    916aae73606d7a9e02a1d3b47c199688

rc4.plain
rc4.plain

Targets

    • Target

      7696bebd150e44a9654f6967786b9aea25da55de933d2355f64b804620d8d16e

    • Size

      1.1MB

    • MD5

      25bf2c82e23392efb173fb9725062f56

    • SHA1

      cb3603fe653cc538c8accfd51acea453be8405b1

    • SHA256

      7696bebd150e44a9654f6967786b9aea25da55de933d2355f64b804620d8d16e

    • SHA512

      fc58c5838ee581adcacc3cacc6697ae63aa001e34cfa2a269bdcba75f4fbd36f17c02149ba39e6d4c275b7f0e07edd1d61ab73a3b6894e2ca130f18b4446f9df

    • SSDEEP

      24576:6yW2TNKlLzmhM08em3kSbTgUPPk2pCAW6rwrdPd3Ikf6bzJn:BW2UZ010D8mbWZ7Ydb

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks