Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    b7b1e5a74ed7024ebd876b849469d2258eacaa3a709e9d930d80a43df6a0ac94

  • Size

    538KB

  • Sample

    230402-qmlrvage46

  • MD5

    e897d6c60d74c348e336bf337e9d48f7

  • SHA1

    2b55c1e23b16afb7d50baa9f49b3bf9dcf699e23

  • SHA256

    b7b1e5a74ed7024ebd876b849469d2258eacaa3a709e9d930d80a43df6a0ac94

  • SHA512

    2fe01439ac971fb9e65427ee3721c92e7ce3e866c39b8cffaca6ceacf0e33dd50a67c51b93553273475367a795692a08efc0d9a321121c5d569bc7ad86b287d7

  • SSDEEP

    12288:zMrwy90HcWOAcgZBfFBo/QgPMWnuAQbaIBBjpq6iq:jymDOAcENWYKM1Ta6q6

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Targets

    • Target

      b7b1e5a74ed7024ebd876b849469d2258eacaa3a709e9d930d80a43df6a0ac94

    • Size

      538KB

    • MD5

      e897d6c60d74c348e336bf337e9d48f7

    • SHA1

      2b55c1e23b16afb7d50baa9f49b3bf9dcf699e23

    • SHA256

      b7b1e5a74ed7024ebd876b849469d2258eacaa3a709e9d930d80a43df6a0ac94

    • SHA512

      2fe01439ac971fb9e65427ee3721c92e7ce3e866c39b8cffaca6ceacf0e33dd50a67c51b93553273475367a795692a08efc0d9a321121c5d569bc7ad86b287d7

    • SSDEEP

      12288:zMrwy90HcWOAcgZBfFBo/QgPMWnuAQbaIBBjpq6iq:jymDOAcENWYKM1Ta6q6

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks