Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    7799d9ab0856da14c309902faf80f02ed2af104b5f813a25a48285d3258ba63a

  • Size

    1.8MB

  • Sample

    240905-2l4rtashjh

  • MD5

    f9ecf7c035b8a0a9d25e5a410b5ae8aa

  • SHA1

    b58234ecf302965af08caed18f417e44f0975c0d

  • SHA256

    7799d9ab0856da14c309902faf80f02ed2af104b5f813a25a48285d3258ba63a

  • SHA512

    b59869c987b360ede9bd4c34da231cd2fedaa9da15582aba21990843976655794a4faba563be3d3b80f25b6c80727dfa0d862ab280758d506624a3ed03e7eb11

  • SSDEEP

    49152:MHhWfEKMow0h53D+6TfledYrmqXuiVFVAjIR+PL:uWcFow4+6xCYNuaF6jIR

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Targets

    • Target

      7799d9ab0856da14c309902faf80f02ed2af104b5f813a25a48285d3258ba63a

    • Size

      1.8MB

    • MD5

      f9ecf7c035b8a0a9d25e5a410b5ae8aa

    • SHA1

      b58234ecf302965af08caed18f417e44f0975c0d

    • SHA256

      7799d9ab0856da14c309902faf80f02ed2af104b5f813a25a48285d3258ba63a

    • SHA512

      b59869c987b360ede9bd4c34da231cd2fedaa9da15582aba21990843976655794a4faba563be3d3b80f25b6c80727dfa0d862ab280758d506624a3ed03e7eb11

    • SSDEEP

      49152:MHhWfEKMow0h53D+6TfledYrmqXuiVFVAjIR+PL:uWcFow4+6xCYNuaF6jIR

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks