Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    NEAS.NEASNEAS25fb27c894f4ba166291b507fd644d3d40fac43159e82c76c48a5ca50d2a7409exeexeexe_JC.exe

  • Size

    1.5MB

  • Sample

    231013-txn7hadg32

  • MD5

    ead5e6056cbe27ccaec949a7dd29854b

  • SHA1

    c962ee4d97b77254384cd4282818bf01f56c5554

  • SHA256

    25fb27c894f4ba166291b507fd644d3d40fac43159e82c76c48a5ca50d2a7409

  • SHA512

    52af114b52f9a4ab16244823f5dfaf00e16cde99fb3d9d4cad5e656d036527bd1e319e45f2f71593b911b674d898bcb3457735549d9e4ed0fdb86c7a39c9e6af

  • SSDEEP

    24576:9ytqKa5nj7NOHB7MyUi8eXMu1y4R5Px4ndVmzloVCeBKj9OGjEfos3PkfIdXqOUh:YtRQn/N0M/h21T8zqoVCwToS/XqfG

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

breha

C2

77.91.124.55:19071

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain

Extracted

Family

redline

Botnet

kukish

C2

77.91.124.55:19071

Extracted

Family

amadey

Version

3.83

C2

http://5.42.65.80/8bmeVwqx/index.php

Attributes
  • install_dir

    207aa4515d

  • install_file

    oneetx.exe

  • strings_key

    3e634dd0840c68ae2ced83c2be7bf0d4

rc4.plain

Extracted

Family

redline

Botnet

pixelscloud

C2

85.209.176.171:80

Extracted

Family

redline

Botnet

@ytlogsbot

C2

185.216.70.238:37515

Targets

    • Target

      NEAS.NEASNEAS25fb27c894f4ba166291b507fd644d3d40fac43159e82c76c48a5ca50d2a7409exeexeexe_JC.exe

    • Size

      1.5MB

    • MD5

      ead5e6056cbe27ccaec949a7dd29854b

    • SHA1

      c962ee4d97b77254384cd4282818bf01f56c5554

    • SHA256

      25fb27c894f4ba166291b507fd644d3d40fac43159e82c76c48a5ca50d2a7409

    • SHA512

      52af114b52f9a4ab16244823f5dfaf00e16cde99fb3d9d4cad5e656d036527bd1e319e45f2f71593b911b674d898bcb3457735549d9e4ed0fdb86c7a39c9e6af

    • SSDEEP

      24576:9ytqKa5nj7NOHB7MyUi8eXMu1y4R5Px4ndVmzloVCeBKj9OGjEfos3PkfIdXqOUh:YtRQn/N0M/h21T8zqoVCwToS/XqfG

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks