Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4745329d76cd60b98eb98a1167bda2059b01fcfc446e3a789a0616f0a02b3012

  • Size

    1.4MB

  • Sample

    230505-wzqjfseg8w

  • MD5

    f123219c68b39a1151a8d00d893f3d63

  • SHA1

    b55b25fb0ac9c3b4fcfc2bcb2c6f1124a90af3fc

  • SHA256

    4745329d76cd60b98eb98a1167bda2059b01fcfc446e3a789a0616f0a02b3012

  • SHA512

    c923b826ee9055c8255580244a305aa6b7de59d2c25f5c05de225fd421e045d65c8adeab4363cd7d72f3bae720e5d63fd5ae22f1467345ad12301bbfe2de68da

  • SSDEEP

    24576:Ly/npwKqOKalPvePftrXHlSdZovNsl5fbMX9GP/NIB/vpKd8iE8jE1k:+hlktrXHlSEv+kX98Nb8irjE

Malware Config

Extracted

Family

redline

Botnet

mask

C2

217.196.96.56:4138

Attributes
  • auth_value

    31aef25be0febb8e491794ef7f502c50

Extracted

Family

redline

Botnet

boom

C2

217.196.96.56:4138

Attributes
  • auth_value

    1ce6aebe15bac07a7bc88b114bc49335

Targets

    • Target

      4745329d76cd60b98eb98a1167bda2059b01fcfc446e3a789a0616f0a02b3012

    • Size

      1.4MB

    • MD5

      f123219c68b39a1151a8d00d893f3d63

    • SHA1

      b55b25fb0ac9c3b4fcfc2bcb2c6f1124a90af3fc

    • SHA256

      4745329d76cd60b98eb98a1167bda2059b01fcfc446e3a789a0616f0a02b3012

    • SHA512

      c923b826ee9055c8255580244a305aa6b7de59d2c25f5c05de225fd421e045d65c8adeab4363cd7d72f3bae720e5d63fd5ae22f1467345ad12301bbfe2de68da

    • SSDEEP

      24576:Ly/npwKqOKalPvePftrXHlSdZovNsl5fbMX9GP/NIB/vpKd8iE8jE1k:+hlktrXHlSEv+kX98Nb8irjE

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks