Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    266b8b19e3e00ebc41e21390e4c1e6bf2cd48439ba3d0c3318f9ca689447f60d

  • Size

    759KB

  • Sample

    230212-2h3qcagd5y

  • MD5

    f00e0445cd7330be8fc6f891e279e643

  • SHA1

    2bd60ec9ff457cef342733ed50b05711e965d46f

  • SHA256

    266b8b19e3e00ebc41e21390e4c1e6bf2cd48439ba3d0c3318f9ca689447f60d

  • SHA512

    b332987086514950d2ffad92ce904d676e454243057376c2de8683ff91f4424c0706533e4a5fa5a8ed64d65e1198286ee5cca059ee3eb76edb05f117161ccf19

  • SSDEEP

    12288:NMrvy90J17+ZxPCwTwWRRPextYb2llaxaRFr9khCYKsjXvt6wSKmFelY:Cyg+ZxPmWXs2ervRFYjft6wSlFe6

Malware Config

Extracted

Family

redline

Botnet

romik

C2

193.233.20.12:4132

Attributes
  • auth_value

    8fb78d2889ba0ca42678b59b884e88ff

Extracted

Family

redline

Botnet

dunm

C2

193.233.20.12:4132

Attributes
  • auth_value

    352959e3707029296ec94306d74e2334

Extracted

Family

redline

Botnet

cr2

C2

176.113.115.17:4132

Attributes
  • auth_value

    4bf573d6f5ab16f3b5e36da6855dc128

Targets

    • Target

      266b8b19e3e00ebc41e21390e4c1e6bf2cd48439ba3d0c3318f9ca689447f60d

    • Size

      759KB

    • MD5

      f00e0445cd7330be8fc6f891e279e643

    • SHA1

      2bd60ec9ff457cef342733ed50b05711e965d46f

    • SHA256

      266b8b19e3e00ebc41e21390e4c1e6bf2cd48439ba3d0c3318f9ca689447f60d

    • SHA512

      b332987086514950d2ffad92ce904d676e454243057376c2de8683ff91f4424c0706533e4a5fa5a8ed64d65e1198286ee5cca059ee3eb76edb05f117161ccf19

    • SSDEEP

      12288:NMrvy90J17+ZxPCwTwWRRPextYb2llaxaRFr9khCYKsjXvt6wSKmFelY:Cyg+ZxPmWXs2ervRFYjft6wSlFe6

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks