Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    6282af023b06b3aa3738df293d06272f69211c298a68980fb156fa01ba274349

  • Size

    1.4MB

  • Sample

    231012-vq5rcafe95

  • MD5

    e61717a6e4a145ad556bf588415cce50

  • SHA1

    21c8e538e75e889a4d6f152d27b8b684586de1a8

  • SHA256

    6282af023b06b3aa3738df293d06272f69211c298a68980fb156fa01ba274349

  • SHA512

    a20df8b2ec26023bf098366090aeeaa4178b6ea3b10a23a8fc0351fe361cb6ba52b2f650ba4c3ec6fb817e46ba2ed0dac2555989dbff56311c8c6aa8af3f574e

  • SSDEEP

    24576:l09Bp2gj9qMbCJuceAxNW8DMhfvY2PdLqz1rIUDBaIjNWGk5Q:l09Bp2w9qHYrpvYKdLwDMcQlQ

Malware Config

Extracted

Family

amadey

Version

3.89

C2

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explonde.exe

  • strings_key

    916aae73606d7a9e02a1d3b47c199688

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d
rc4.plain
1
a091ec0a6e22276a96a99c1d34ef679c

Extracted

Family

redline

Botnet

monik

C2

77.91.124.82:19071

Attributes
  • auth_value

    da7d9ea0878f5901f1f8319d34bdccea

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
1
0x4b3b02b6
rc4.i32
1
0x6ea683ed

Extracted

Family

redline

Botnet

pixelscloud2.0

C2

85.209.176.128:80

Extracted

Family

redline

Botnet

@ytlogsbot

C2

185.216.70.238:37515

Targets

    • Target

      6282af023b06b3aa3738df293d06272f69211c298a68980fb156fa01ba274349

    • Size

      1.4MB

    • MD5

      e61717a6e4a145ad556bf588415cce50

    • SHA1

      21c8e538e75e889a4d6f152d27b8b684586de1a8

    • SHA256

      6282af023b06b3aa3738df293d06272f69211c298a68980fb156fa01ba274349

    • SHA512

      a20df8b2ec26023bf098366090aeeaa4178b6ea3b10a23a8fc0351fe361cb6ba52b2f650ba4c3ec6fb817e46ba2ed0dac2555989dbff56311c8c6aa8af3f574e

    • SSDEEP

      24576:l09Bp2gj9qMbCJuceAxNW8DMhfvY2PdLqz1rIUDBaIjNWGk5Q:l09Bp2w9qHYrpvYKdLwDMcQlQ

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detect Mystic stealer payload

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • Mystic

      Mystic is an infostealer written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Downloads MZ/PE file

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.