Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2bc3f6a054819f65ffa59d6d26f462a4adb9ee47f114c112960fcc6d756044a9

  • Size

    1.8MB

  • Sample

    240614-zmpceayhmp

  • MD5

    1348753ebe79710e41746f471f0a5903

  • SHA1

    56300fae453869bd62102e44e93f6fa92ab4f185

  • SHA256

    2bc3f6a054819f65ffa59d6d26f462a4adb9ee47f114c112960fcc6d756044a9

  • SHA512

    d3bd0a11019083fa79832a88d21529f6b78d4c16d3939a2498014f6d49598d786cf44bccdfa2178eebc72537f645bf0dc0e95b91eb8398733c9ede21ef15d97c

  • SSDEEP

    49152:hWs9OcbbxGwhkvjl0OQIs+UTc+ROivGham8Lc6DvBiuJkaP79:hWyxYvjIBg0Oidm8Lc6DpRD9

Malware Config

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

C2

http://77.91.77.81

Attributes
  • install_dir

    8254624243

  • install_file

    axplong.exe

  • strings_key

    90049e51fabf09df0d6748e0b271922e

  • url_paths

    /Kiru9gu/index.php

rc4.plain
1
a091ec0a6e22276a96a99c1d34ef679c

Targets

    • Target

      2bc3f6a054819f65ffa59d6d26f462a4adb9ee47f114c112960fcc6d756044a9

    • Size

      1.8MB

    • MD5

      1348753ebe79710e41746f471f0a5903

    • SHA1

      56300fae453869bd62102e44e93f6fa92ab4f185

    • SHA256

      2bc3f6a054819f65ffa59d6d26f462a4adb9ee47f114c112960fcc6d756044a9

    • SHA512

      d3bd0a11019083fa79832a88d21529f6b78d4c16d3939a2498014f6d49598d786cf44bccdfa2178eebc72537f645bf0dc0e95b91eb8398733c9ede21ef15d97c

    • SSDEEP

      49152:hWs9OcbbxGwhkvjl0OQIs+UTc+ROivGham8Lc6DvBiuJkaP79:hWyxYvjIBg0Oidm8Lc6DpRD9

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.