Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a9a9bd11f6b57775bd12de3f212577f8e1044f6ca3c17d3ac8454163685db9a1

  • Size

    1.8MB

  • Sample

    240620-cks69axdmr

  • MD5

    fe98eb6e50b8b06a2afa7a18cafe88e2

  • SHA1

    fe5ba0701c78dcbb6e80a7e80e9c021257c22a9a

  • SHA256

    a9a9bd11f6b57775bd12de3f212577f8e1044f6ca3c17d3ac8454163685db9a1

  • SHA512

    88448ea29ea58f67e5507d13e1e80fa723463c5db674a3e34a9888e809fe47bfa6728e9a540b2204e590b02deb56cec11d6641d504a4fcd6b402b13142f08916

  • SSDEEP

    49152:IXSk4/CJjNDI6s+nrzirn3GztzMXG+EkQqZNvl5th:IXSVaJjNs6sOcGxzM1EkQaNvl5t

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

C2

http://147.45.47.155

Attributes
  • install_dir

    9217037dc9

  • install_file

    explortu.exe

  • strings_key

    8e894a8a4a3d0da8924003a561cfb244

  • url_paths

    /ku4Nor9/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

C2

http://77.91.77.81

Attributes
  • install_dir

    8254624243

  • install_file

    axplong.exe

  • strings_key

    90049e51fabf09df0d6748e0b271922e

  • url_paths

    /Kiru9gu/index.php

rc4.plain
1
a091ec0a6e22276a96a99c1d34ef679c

Extracted

Family

redline

Botnet

newbild

C2

185.215.113.67:40960

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

C2

185.172.128.33:8970

Extracted

Family

risepro

C2

77.91.77.66:58709

Extracted

Family

redline

Botnet

LiveTraffic

C2

4.185.27.237:13528

Extracted

Family

lumma

C2

https://parallelmercywksoffw.shop/api

https://liabiliytshareodlkv.shop/api

https://notoriousdcellkw.shop/api

https://conferencefreckewl.shop/api

https://flourhishdiscovrw.shop/api

https://landdumpycolorwskfw.shop/api

https://willingyhollowsk.shop/api

https://barebrilliancedkoso.shop/api

https://distincttangyflippan.shop/api

https://macabrecondfucews.shop/api

https://greentastellesqwm.shop/api

https://stickyyummyskiwffe.shop/api

https://sturdyregularrmsnhw.shop/api

https://lamentablegapingkwaq.shop/api

https://innerverdanytiresw.shop/api

https://standingcomperewhitwo.shop/api

https://accumulationeyerwos.shop/api

https://publicitycharetew.shop/api

https://computerexcudesp.shop/api

https://leafcalfconflcitw.shop/api

Targets

    • Target

      a9a9bd11f6b57775bd12de3f212577f8e1044f6ca3c17d3ac8454163685db9a1

    • Size

      1.8MB

    • MD5

      fe98eb6e50b8b06a2afa7a18cafe88e2

    • SHA1

      fe5ba0701c78dcbb6e80a7e80e9c021257c22a9a

    • SHA256

      a9a9bd11f6b57775bd12de3f212577f8e1044f6ca3c17d3ac8454163685db9a1

    • SHA512

      88448ea29ea58f67e5507d13e1e80fa723463c5db674a3e34a9888e809fe47bfa6728e9a540b2204e590b02deb56cec11d6641d504a4fcd6b402b13142f08916

    • SSDEEP

      49152:IXSk4/CJjNDI6s+nrzirn3GztzMXG+EkQqZNvl5th:IXSVaJjNs6sOcGxzM1EkQaNvl5t

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Monster Stealer.

    • Exela Stealer

      Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • Monster

      Monster is a Golang stealer that was discovered in 2024.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Creates new service(s)

    • Downloads MZ/PE file

    • Modifies Windows Firewall

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • Hide Artifacts: Hidden Files and Directories

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.