Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    6b44e61780776a20e0e5cf557c600748f490b92b

  • Size

    345KB

  • Sample

    230115-x72r5abc89

  • MD5

    a6db211824cfcc618ccb6ef4d63559cd

  • SHA1

    6b44e61780776a20e0e5cf557c600748f490b92b

  • SHA256

    46e1c91ab03398f776efc4a39fccd7ebb8c749a6c5ba18ca486b9d4660117256

  • SHA512

    d920f07089dde273bf62fc9ee81fb8e1c0203cf10f599f5b050a146a923f866929ce2bae273299bb63f0128371c31f6940b08ab410d61ce25ad91d6b7e8e9d21

  • SSDEEP

    6144:c3Qawf55fX1K/WfxXrHo9/z1/TY9JCGyvX6y3v60cjdtsFXAOrR6Gsc:c3Qawh5fX1K/WdrHo9rZTY9tbsxtgG7

Malware Config

Extracted

Family

redline

Botnet

1

C2

107.182.129.73:21733

Attributes
  • auth_value

    3a5bb0917495b4312d052a0b8977d2bb

Targets

    • Target

      6b44e61780776a20e0e5cf557c600748f490b92b

    • Size

      345KB

    • MD5

      a6db211824cfcc618ccb6ef4d63559cd

    • SHA1

      6b44e61780776a20e0e5cf557c600748f490b92b

    • SHA256

      46e1c91ab03398f776efc4a39fccd7ebb8c749a6c5ba18ca486b9d4660117256

    • SHA512

      d920f07089dde273bf62fc9ee81fb8e1c0203cf10f599f5b050a146a923f866929ce2bae273299bb63f0128371c31f6940b08ab410d61ce25ad91d6b7e8e9d21

    • SSDEEP

      6144:c3Qawf55fX1K/WfxXrHo9/z1/TY9JCGyvX6y3v60cjdtsFXAOrR6Gsc:c3Qawh5fX1K/WdrHo9rZTY9tbsxtgG7

    • Modifies security service

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Stops running service(s)

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks