Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ee3a857a60743374792ce5b0d9437dbf.exe

  • Size

    1.0MB

  • Sample

    230414-p87qrshh62

  • MD5

    ee3a857a60743374792ce5b0d9437dbf

  • SHA1

    9d008dec85152d4e6eea32bb65d05dbcbf14c345

  • SHA256

    74691bdffb5d48afea5f9895a446f8bbba3af4e958fd4fd82fc3cd916ba80f68

  • SHA512

    8903f244f1d2ad1632dc14e34efa981fbb462ca4b2384ad35d142b514c4910467e74a6b9b5c3651004de812d577450deffb9234f3653c8727831b2f58210bba7

  • SSDEEP

    24576:zyRsjaPqzAt2nIIaugyfsutV6dq7vHWSx5GX:GRsjaPF2niugVuL6dAuSx4

Malware Config

Extracted

Family

redline

Botnet

soft

C2

77.91.124.146:4121

Attributes
  • auth_value

    e65663e455bca3c5699650b66e76ceaa

Extracted

Family

redline

Botnet

dirx

C2

77.91.124.146:4121

Attributes
  • auth_value

    522d988f763be056e53e089f74d464cc

Targets

    • Target

      ee3a857a60743374792ce5b0d9437dbf.exe

    • Size

      1.0MB

    • MD5

      ee3a857a60743374792ce5b0d9437dbf

    • SHA1

      9d008dec85152d4e6eea32bb65d05dbcbf14c345

    • SHA256

      74691bdffb5d48afea5f9895a446f8bbba3af4e958fd4fd82fc3cd916ba80f68

    • SHA512

      8903f244f1d2ad1632dc14e34efa981fbb462ca4b2384ad35d142b514c4910467e74a6b9b5c3651004de812d577450deffb9234f3653c8727831b2f58210bba7

    • SSDEEP

      24576:zyRsjaPqzAt2nIIaugyfsutV6dq7vHWSx5GX:GRsjaPF2niugVuL6dAuSx4

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks