Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    8636bfa8ffc9df2512ca2147164baef4d542202bf15025a19c36be7526126e1a

  • Size

    720KB

  • Sample

    230325-v29jnsdf95

  • MD5

    f603831bcdb6dab29e5231ee6b0d8c59

  • SHA1

    e71f49d34f7eba94d86597cf6f886cec597e0d3b

  • SHA256

    8636bfa8ffc9df2512ca2147164baef4d542202bf15025a19c36be7526126e1a

  • SHA512

    f6563489859f0dfcf453b6cc744efdfa646e18bc834cb9f1141148ce8528616f33ea7d9de1196b6f5a1bcfdd633497504efd0c1655815f3f8fdcc93669fb46fe

  • SSDEEP

    12288:DLrfxjYSBIeOllQw61Lt8xOWHF1GM12zDN9YolbvALA505LiBMTHo/922xOJFIu:DLSS3ob1hYP3nT6FMU2xE3

Malware Config

Extracted

Family

redline

Botnet

boris

C2

193.233.20.32:4125

Attributes
  • auth_value

    766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

viza

C2

193.233.20.32:4125

Attributes
  • auth_value

    153a106a89fae7251f2dc17be2eb5720

Targets

    • Target

      8636bfa8ffc9df2512ca2147164baef4d542202bf15025a19c36be7526126e1a

    • Size

      720KB

    • MD5

      f603831bcdb6dab29e5231ee6b0d8c59

    • SHA1

      e71f49d34f7eba94d86597cf6f886cec597e0d3b

    • SHA256

      8636bfa8ffc9df2512ca2147164baef4d542202bf15025a19c36be7526126e1a

    • SHA512

      f6563489859f0dfcf453b6cc744efdfa646e18bc834cb9f1141148ce8528616f33ea7d9de1196b6f5a1bcfdd633497504efd0c1655815f3f8fdcc93669fb46fe

    • SSDEEP

      12288:DLrfxjYSBIeOllQw61Lt8xOWHF1GM12zDN9YolbvALA505LiBMTHo/922xOJFIu:DLSS3ob1hYP3nT6FMU2xE3

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks