Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    3bef2f84a63d0bd042489e239ff3ad70617d15b45b71e8d5bb2cb4f460a8c008

  • Size

    414KB

  • Sample

    240619-tl2cpaxgql

  • MD5

    4c3158a6f1e1b42a943637dd968da75b

  • SHA1

    dec429d3e401bf9c53630ff6b0d1fa8bb3e4bb83

  • SHA256

    3bef2f84a63d0bd042489e239ff3ad70617d15b45b71e8d5bb2cb4f460a8c008

  • SHA512

    a42784e3cef0001b85797157db738581c259f5a6b6505205354f09a7ad71e4c3c923b2761ce483ab4d1edeef1810d3d7b3c42ef847d92b60a8c341694a53d4b3

  • SSDEEP

    6144:+2SbPYgnAMh0SizACrYVWgxRbKMxjx2BW2RI8e5WAw7+cH:+XPYg/8AC8RxRbKMxjsB7RI8e5WjFH

Score
10/10

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

b2c2c1

C2

http://greendag.ru

Attributes
  • install_dir

    e221f72865

  • install_file

    Dctooux.exe

  • strings_key

    09a7af7983af08af50ea3f51a73065e9

  • url_paths

    /forum/index.php

rc4.plain

Targets

    • Target

      3bef2f84a63d0bd042489e239ff3ad70617d15b45b71e8d5bb2cb4f460a8c008

    • Size

      414KB

    • MD5

      4c3158a6f1e1b42a943637dd968da75b

    • SHA1

      dec429d3e401bf9c53630ff6b0d1fa8bb3e4bb83

    • SHA256

      3bef2f84a63d0bd042489e239ff3ad70617d15b45b71e8d5bb2cb4f460a8c008

    • SHA512

      a42784e3cef0001b85797157db738581c259f5a6b6505205354f09a7ad71e4c3c923b2761ce483ab4d1edeef1810d3d7b3c42ef847d92b60a8c341694a53d4b3

    • SSDEEP

      6144:+2SbPYgnAMh0SizACrYVWgxRbKMxjx2BW2RI8e5WAw7+cH:+XPYg/8AC8RxRbKMxjsB7RI8e5WjFH

    Score
    10/10
    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks