Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    b8c12b4c38646e3769a448e6bd8f6b5528bfa0b9fb397c31f7448b13d26a1eee

  • Size

    687KB

  • Sample

    230326-rs1cvsgg93

  • MD5

    006305a44a9fe801ca1208e9a0e69044

  • SHA1

    8aa035b8378eebf0c8e2d8e0f5c5fecd844b085f

  • SHA256

    b8c12b4c38646e3769a448e6bd8f6b5528bfa0b9fb397c31f7448b13d26a1eee

  • SHA512

    6ae081db45d8a1430313b50a191730ab34ff9a1f74d94082fd93826d36de3bdd297c49432fcd64835c1fcb52467edabe7222a7cee5a1fa4384ad1b7b9d856a0d

  • SSDEEP

    12288:lMr+y90QeQo/NSSc+HQKl0Nzazd9OrGfe7VTIgmiWr9Y2dQdN:bybeQo/bcmdqFUdaglJiWr9Y2dkN

Malware Config

Extracted

Family

redline

Botnet

boris

C2

193.233.20.32:4125

Attributes
  • auth_value

    766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

dogma

C2

193.233.20.32:4125

Attributes
  • auth_value

    1b692976ca991040f2e8890409c35142

Targets

    • Target

      b8c12b4c38646e3769a448e6bd8f6b5528bfa0b9fb397c31f7448b13d26a1eee

    • Size

      687KB

    • MD5

      006305a44a9fe801ca1208e9a0e69044

    • SHA1

      8aa035b8378eebf0c8e2d8e0f5c5fecd844b085f

    • SHA256

      b8c12b4c38646e3769a448e6bd8f6b5528bfa0b9fb397c31f7448b13d26a1eee

    • SHA512

      6ae081db45d8a1430313b50a191730ab34ff9a1f74d94082fd93826d36de3bdd297c49432fcd64835c1fcb52467edabe7222a7cee5a1fa4384ad1b7b9d856a0d

    • SSDEEP

      12288:lMr+y90QeQo/NSSc+HQKl0Nzazd9OrGfe7VTIgmiWr9Y2dQdN:bybeQo/bcmdqFUdaglJiWr9Y2dkN

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks