Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    3ce88ad0bb7917bde965f5861780f4d053bfe921f635c7cb512475bc5e9f373d

  • Size

    793KB

  • Sample

    230316-tzpaaaeb3w

  • MD5

    2c2a2e209172b051755fa7fa0203f1a0

  • SHA1

    6d88b2b81d411f1063c66aaa14ce3191e4473bc6

  • SHA256

    3ce88ad0bb7917bde965f5861780f4d053bfe921f635c7cb512475bc5e9f373d

  • SHA512

    12da53ca6e56ded530acbb8aeeaae854ecfa8c9affafb08abed088af4e0e76194c9753b10201177d75b4711db9b5139c7442bc67d93c13f6d5ce721d56198e02

  • SSDEEP

    12288:aMr+y90Fq856VdLm9FVGYK/My1BR/+frlv+BvlCHbCovVb/GHLOj:oygVkbLm9FVrqmfrmvlcb/NbOHLOj

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

rako

C2

193.233.20.28:4125

Attributes
  • auth_value

    69e2d139981e0b037a6786e01a92824d

Targets

    • Target

      3ce88ad0bb7917bde965f5861780f4d053bfe921f635c7cb512475bc5e9f373d

    • Size

      793KB

    • MD5

      2c2a2e209172b051755fa7fa0203f1a0

    • SHA1

      6d88b2b81d411f1063c66aaa14ce3191e4473bc6

    • SHA256

      3ce88ad0bb7917bde965f5861780f4d053bfe921f635c7cb512475bc5e9f373d

    • SHA512

      12da53ca6e56ded530acbb8aeeaae854ecfa8c9affafb08abed088af4e0e76194c9753b10201177d75b4711db9b5139c7442bc67d93c13f6d5ce721d56198e02

    • SSDEEP

      12288:aMr+y90Fq856VdLm9FVGYK/My1BR/+frlv+BvlCHbCovVb/GHLOj:oygVkbLm9FVrqmfrmvlcb/NbOHLOj

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks