Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2caa55fb9de38dfba656013f5631f1e90d49eb563eba7cb23dd1e0608c08b124

  • Size

    659KB

  • Sample

    230401-q8xq8sad72

  • MD5

    d017fabcfcd10bb0301006800b146038

  • SHA1

    df8045122b218cfa84eb965b22ccd2e94b1a6f42

  • SHA256

    2caa55fb9de38dfba656013f5631f1e90d49eb563eba7cb23dd1e0608c08b124

  • SHA512

    e995277a96a7d3e13f4ba1dd0ee517756cb88a1270f1fb5e819010c3370d6366460c9e1421458626dec7d5d2f1dd5071838c7774b4b1f8f81e91003132c8c7fb

  • SSDEEP

    12288:NMrFy90ly2ZtZnboiWElqPNrTswqpVdU1IKjHQoqBiTVQ9a1eRr99FgN:wy6y2ZtZbpkyfGfzQDj9a1K5IN

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Targets

    • Target

      2caa55fb9de38dfba656013f5631f1e90d49eb563eba7cb23dd1e0608c08b124

    • Size

      659KB

    • MD5

      d017fabcfcd10bb0301006800b146038

    • SHA1

      df8045122b218cfa84eb965b22ccd2e94b1a6f42

    • SHA256

      2caa55fb9de38dfba656013f5631f1e90d49eb563eba7cb23dd1e0608c08b124

    • SHA512

      e995277a96a7d3e13f4ba1dd0ee517756cb88a1270f1fb5e819010c3370d6366460c9e1421458626dec7d5d2f1dd5071838c7774b4b1f8f81e91003132c8c7fb

    • SSDEEP

      12288:NMrFy90ly2ZtZnboiWElqPNrTswqpVdU1IKjHQoqBiTVQ9a1eRr99FgN:wy6y2ZtZbpkyfGfzQDj9a1K5IN

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.