Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    89942c3e51397072722225283650250c1244ac0201db45c795685b3bb2bc52e6

  • Size

    683KB

  • Sample

    230327-ax3v4sag23

  • MD5

    84f5fb9df449978d540e1bfb39df93ed

  • SHA1

    3dc0d24b02920bd8ebccaea30d99029a47a50e4f

  • SHA256

    89942c3e51397072722225283650250c1244ac0201db45c795685b3bb2bc52e6

  • SHA512

    163bc41995e60a761d2c2b9149057e6e23d262a5dd6a5f69477a5e84ded7a199aa8e33e831560fa76353a2330a149bc6959d7710abeac938e06442d67a4696ec

  • SSDEEP

    12288:5Mr5y90AqqAjVN2kYpdeudvQNr+vCb1YIpB1+qbwiS0n2UqEWntm6x:QybqquN2kYacvQt+v6b1BbM0n2UqEWnX

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes
  • auth_value

    1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

dent

C2

193.233.20.33:4125

Attributes
  • auth_value

    e795368557f02e28e8aef6bcb279a3b0

Targets

    • Target

      89942c3e51397072722225283650250c1244ac0201db45c795685b3bb2bc52e6

    • Size

      683KB

    • MD5

      84f5fb9df449978d540e1bfb39df93ed

    • SHA1

      3dc0d24b02920bd8ebccaea30d99029a47a50e4f

    • SHA256

      89942c3e51397072722225283650250c1244ac0201db45c795685b3bb2bc52e6

    • SHA512

      163bc41995e60a761d2c2b9149057e6e23d262a5dd6a5f69477a5e84ded7a199aa8e33e831560fa76353a2330a149bc6959d7710abeac938e06442d67a4696ec

    • SSDEEP

      12288:5Mr5y90AqqAjVN2kYpdeudvQNr+vCb1YIpB1+qbwiS0n2UqEWntm6x:QybqquN2kYacvQt+v6b1BbM0n2UqEWnX

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks