Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

TBM Setup.exe

windows7-x64

10

TBM Setup.exe

windows10-2004-x64

10

Resubmissions

19/04/2023, 16:52

230419-vdkkmsea4z 10

19/04/2023, 15:39

230419-s32jcadd4t 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TBM Setup.exe

  • Size

    61.8MB

  • Sample

    230419-vdkkmsea4z

  • MD5

    83024ea067ab552d39ffdb6e12a30817

  • SHA1

    23d6b96f806e1ca8a10dfa16e7f35b3f2801a489

  • SHA256

    f96f3a4f4cdab5176a055736464d979f7cbd902298c910cbbdb08e955695bf73

  • SHA512

    8c8341a179f30cc5a4c9cb3efd70f65a5e337e3ba948677014b9433361a70c84274a871dfe385612511d73a5356d1eda2c2ea3f1a50aecdb557bbf2aeae861f3

  • SSDEEP

    1572864:jtve1M4rkN1winHaBHNYV6vSAuZ8F0Pa7:jlSCpnq6xbPa7

Score
10/10
redlineinfostealerspywarestealer

Malware Config

Targets

    • Target

      TBM Setup.exe

    • Size

      61.8MB

    • MD5

      83024ea067ab552d39ffdb6e12a30817

    • SHA1

      23d6b96f806e1ca8a10dfa16e7f35b3f2801a489

    • SHA256

      f96f3a4f4cdab5176a055736464d979f7cbd902298c910cbbdb08e955695bf73

    • SHA512

      8c8341a179f30cc5a4c9cb3efd70f65a5e337e3ba948677014b9433361a70c84274a871dfe385612511d73a5356d1eda2c2ea3f1a50aecdb557bbf2aeae861f3

    • SSDEEP

      1572864:jtve1M4rkN1winHaBHNYV6vSAuZ8F0Pa7:jlSCpnq6xbPa7

    Score
    10/10
    redlineinfostealerspywarestealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Detects any file with a triage score of 10

      This file has been assigned a triage score of 10, indicating a high likelihood of malicious behavior.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks