Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    setup.exe

  • Size

    1.8MB

  • Sample

    240729-23dxqavfmk

  • MD5

    62784b54dca4829a61e16d31b8e30f87

  • SHA1

    2323b4b01ea18b4478ecb41309e24d64ad52746d

  • SHA256

    7886c7f2eb19e688c8ab3382e4cb3ceb39d63a7dc8b920f7e0d29a628cc9b4bd

  • SHA512

    7e06144259680af23fabb3c225daaccaf930a7313ca3ccf9639addd119acf13a41b23c764be08259a1643077475d8edc51e08e46a699a75f61fc2ff07d2e56a3

  • SSDEEP

    49152:tP1Dp0xtpy4XriZY20Tf7b7X34fYXmag9kUVVo:Z0vI4X2ZY20Tzb7XIf2GHo

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

C2

http://185.215.113.19

Attributes
  • install_dir

    0d8f5eb8a7

  • install_file

    explorti.exe

  • strings_key

    6c55a5f34bb433fbd933a168577b1838

  • url_paths

    /Vi9leo/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain
1
a091ec0a6e22276a96a99c1d34ef679c

Extracted

Family

redline

Botnet

25072023

C2

185.215.113.67:40960

Extracted

Family

redline

Botnet

Logs

C2

185.215.113.9:9137

Targets

    • Target

      setup.exe

    • Size

      1.8MB

    • MD5

      62784b54dca4829a61e16d31b8e30f87

    • SHA1

      2323b4b01ea18b4478ecb41309e24d64ad52746d

    • SHA256

      7886c7f2eb19e688c8ab3382e4cb3ceb39d63a7dc8b920f7e0d29a628cc9b4bd

    • SHA512

      7e06144259680af23fabb3c225daaccaf930a7313ca3ccf9639addd119acf13a41b23c764be08259a1643077475d8edc51e08e46a699a75f61fc2ff07d2e56a3

    • SSDEEP

      49152:tP1Dp0xtpy4XriZY20Tf7b7X34fYXmag9kUVVo:Z0vI4X2ZY20Tzb7XIf2GHo

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detects Monster Stealer.

    • Exela Stealer

      Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

    • Monster

      Monster is a Golang stealer that was discovered in 2024.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Modifies Windows Firewall

    • Stops running service(s)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Drops startup file

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Network Service Discovery

      Attempt to gather information on host's network.

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    • Enumerates processes with tasklist

    • Hide Artifacts: Hidden Files and Directories

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.