Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    1daae8343986e67f99aff5df1a9a18286dcbb5a2ceffd7bd9e6885f642a33e73

  • Size

    385KB

  • Sample

    230308-11f4mahd49

  • MD5

    cff3641306bfb479353d12010f4d9e7e

  • SHA1

    be4fd279c3bf6f559b2ccb15d60d5949fbada1ad

  • SHA256

    1daae8343986e67f99aff5df1a9a18286dcbb5a2ceffd7bd9e6885f642a33e73

  • SHA512

    4035957699740023ed3c47e4ab13b326142aff767d770eac0281352dac62dafd7ed6c4ff4ffd52875e7930e6e0264714c6e08bb741afb2f0a6cfcdc10d7fd699

  • SSDEEP

    6144:Koy+bnr+ap0yN90QEFnJV63upgdOUlnRXE06NgnUW/wAXCEreDJ5pK+nB35s6B:AMrGy90NCNd/nR00jnUewASx5pV5s6B

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Targets

    • Target

      1daae8343986e67f99aff5df1a9a18286dcbb5a2ceffd7bd9e6885f642a33e73

    • Size

      385KB

    • MD5

      cff3641306bfb479353d12010f4d9e7e

    • SHA1

      be4fd279c3bf6f559b2ccb15d60d5949fbada1ad

    • SHA256

      1daae8343986e67f99aff5df1a9a18286dcbb5a2ceffd7bd9e6885f642a33e73

    • SHA512

      4035957699740023ed3c47e4ab13b326142aff767d770eac0281352dac62dafd7ed6c4ff4ffd52875e7930e6e0264714c6e08bb741afb2f0a6cfcdc10d7fd699

    • SSDEEP

      6144:Koy+bnr+ap0yN90QEFnJV63upgdOUlnRXE06NgnUW/wAXCEreDJ5pK+nB35s6B:AMrGy90NCNd/nR00jnUewASx5pV5s6B

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks