Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    534104dc528bab9c04ce1151f056127be6cd9446b4aa517c960206b8d65b995f

  • Size

    817KB

  • Sample

    230215-spknnscb8y

  • MD5

    6d4a53922da1179aa6285a91a2ea9200

  • SHA1

    3a26be7cc84b649b92a0a7b99035fd2c0c3c1d86

  • SHA256

    534104dc528bab9c04ce1151f056127be6cd9446b4aa517c960206b8d65b995f

  • SHA512

    0d7d176b828d92af09f44adbd165e8016d730513bbae929ee261733748933b5aaed2cc6ca7aa736f25523c1ab10091e342a0a691b83094f6ab14aef6adf8ed39

  • SSDEEP

    12288:3Mrdy90r0ERCuQmMHVJCWZ57nNl9t/CYP/GoxQW8CF/zGvlDYLQZdJifqTue:6yXaCuQmMvCe5brNmNW8CF/zy4QZxTd

Malware Config

Extracted

Family

redline

Botnet

dubka

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5a9421183a033f283b2f23139b471f0

Targets

    • Target

      534104dc528bab9c04ce1151f056127be6cd9446b4aa517c960206b8d65b995f

    • Size

      817KB

    • MD5

      6d4a53922da1179aa6285a91a2ea9200

    • SHA1

      3a26be7cc84b649b92a0a7b99035fd2c0c3c1d86

    • SHA256

      534104dc528bab9c04ce1151f056127be6cd9446b4aa517c960206b8d65b995f

    • SHA512

      0d7d176b828d92af09f44adbd165e8016d730513bbae929ee261733748933b5aaed2cc6ca7aa736f25523c1ab10091e342a0a691b83094f6ab14aef6adf8ed39

    • SSDEEP

      12288:3Mrdy90r0ERCuQmMHVJCWZ57nNl9t/CYP/GoxQW8CF/zGvlDYLQZdJifqTue:6yXaCuQmMvCe5brNmNW8CF/zy4QZxTd

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.