Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    66108d74050dc66173531ce6f133b03b14a5f4e08489e7d7ea093eb2b41165f5

  • Size

    481KB

  • Sample

    230214-egfsvshh7z

  • MD5

    ed1be2637cf0bcf2f6cd4dbaef7aed6b

  • SHA1

    dafb8262350d4afb7f4ef204726bc072339da0d3

  • SHA256

    66108d74050dc66173531ce6f133b03b14a5f4e08489e7d7ea093eb2b41165f5

  • SHA512

    bbf14f3272a3fad1ad1b120a4ad4a4d5f51d6776b50860f8ff0ff3a523cdc9275ef90adb312c9df0762e98bf3981292cfd6ad7d7986d59620457a6ee5c35b5c5

  • SSDEEP

    12288:0MrJy90ArJVGVhXkaxWWOCSNjeNxDsKBu:dyFtkVCav7SNCK

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      66108d74050dc66173531ce6f133b03b14a5f4e08489e7d7ea093eb2b41165f5

    • Size

      481KB

    • MD5

      ed1be2637cf0bcf2f6cd4dbaef7aed6b

    • SHA1

      dafb8262350d4afb7f4ef204726bc072339da0d3

    • SHA256

      66108d74050dc66173531ce6f133b03b14a5f4e08489e7d7ea093eb2b41165f5

    • SHA512

      bbf14f3272a3fad1ad1b120a4ad4a4d5f51d6776b50860f8ff0ff3a523cdc9275ef90adb312c9df0762e98bf3981292cfd6ad7d7986d59620457a6ee5c35b5c5

    • SSDEEP

      12288:0MrJy90ArJVGVhXkaxWWOCSNjeNxDsKBu:dyFtkVCav7SNCK

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.