Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    46960e564c51626515f00a74b8a36d18e45489930c03f7b4d9e5ce7c0c59e6e4

  • Size

    720KB

  • Sample

    230325-xy7xsaea97

  • MD5

    09405f6b994441aa139dce0d39b94681

  • SHA1

    e46d7e94368a1a9f4bdad001f4c445d879c596c8

  • SHA256

    46960e564c51626515f00a74b8a36d18e45489930c03f7b4d9e5ce7c0c59e6e4

  • SHA512

    7b782f651454ea592b09347201263dd7dc84472cb5139589b7e5afd744a21789d21e51c29a58272a23745bd20d5962664da17e8881d2b35292dbb0a40fd66893

  • SSDEEP

    12288:GCiSxcYSetZPR8lT5bPgjJLOAVZUm/SFbhFCAxfQBxOBDQDOU6uu:GC5SEPe3buLOA8m/wbXCL4BkOZ

Malware Config

Extracted

Family

redline

Botnet

boris

C2

193.233.20.32:4125

Attributes
  • auth_value

    766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

viza

C2

193.233.20.32:4125

Attributes
  • auth_value

    153a106a89fae7251f2dc17be2eb5720

Targets

    • Target

      46960e564c51626515f00a74b8a36d18e45489930c03f7b4d9e5ce7c0c59e6e4

    • Size

      720KB

    • MD5

      09405f6b994441aa139dce0d39b94681

    • SHA1

      e46d7e94368a1a9f4bdad001f4c445d879c596c8

    • SHA256

      46960e564c51626515f00a74b8a36d18e45489930c03f7b4d9e5ce7c0c59e6e4

    • SHA512

      7b782f651454ea592b09347201263dd7dc84472cb5139589b7e5afd744a21789d21e51c29a58272a23745bd20d5962664da17e8881d2b35292dbb0a40fd66893

    • SSDEEP

      12288:GCiSxcYSetZPR8lT5bPgjJLOAVZUm/SFbhFCAxfQBxOBDQDOU6uu:GC5SEPe3buLOA8m/wbXCL4BkOZ

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks