Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    285695c649e53760b921fabf7ee7b1e76f4e4e9ba07bf7a629ee4194644a99ca

  • Size

    556KB

  • Sample

    230503-2vdlzsha45

  • MD5

    fa45898576f21be7ff41b01973a5b52c

  • SHA1

    2003e8f8e9545546ce5030f352a99d1d0d957645

  • SHA256

    285695c649e53760b921fabf7ee7b1e76f4e4e9ba07bf7a629ee4194644a99ca

  • SHA512

    9e1f5f9bda1161c07e31154f66387e8f239e4a44f5a9b6f0dab0b5e91542fbcc088b789384525c6fac12f51c8c02d41dbed4b425180d4d897935f8a6970218a3

  • SSDEEP

    12288:YMrey90iYU1PhojOZmgL4dS7RwQDS/ZjwYzEWwA:myVF7E0OL/SYzAA

Malware Config

Extracted

Family

redline

Botnet

darm

C2

217.196.96.56:4138

Attributes
  • auth_value

    d88ac8ccc04ab9979b04b46313db1648

Targets

    • Target

      285695c649e53760b921fabf7ee7b1e76f4e4e9ba07bf7a629ee4194644a99ca

    • Size

      556KB

    • MD5

      fa45898576f21be7ff41b01973a5b52c

    • SHA1

      2003e8f8e9545546ce5030f352a99d1d0d957645

    • SHA256

      285695c649e53760b921fabf7ee7b1e76f4e4e9ba07bf7a629ee4194644a99ca

    • SHA512

      9e1f5f9bda1161c07e31154f66387e8f239e4a44f5a9b6f0dab0b5e91542fbcc088b789384525c6fac12f51c8c02d41dbed4b425180d4d897935f8a6970218a3

    • SSDEEP

      12288:YMrey90iYU1PhojOZmgL4dS7RwQDS/ZjwYzEWwA:myVF7E0OL/SYzAA

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks