Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

f2f68f672b...ec.exe

windows7-x64

10

f2f68f672b...ec.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f2f68f672b62fc65e343afea6c3e49a2cd43905904eb68de308fcc3bc6d8e3ec.bin

  • Size

    695KB

  • Sample

    230505-y9c28afc4s

  • MD5

    48fd845cfc42eb2c4dc4cb03c23b27c8

  • SHA1

    3dc94ca3d3de1979949d0440cdc8103cff8064c6

  • SHA256

    f2f68f672b62fc65e343afea6c3e49a2cd43905904eb68de308fcc3bc6d8e3ec

  • SHA512

    fe3ee9eae6f79dbedea2d4ad6796d678bdae181a6be06c92876d7fc29de6359d907ae330d48727575ae26ea6129f83b5fc3996b04b000e38509f5a64a440af4d

  • SSDEEP

    12288:cy90kUn4MnLH7mFrehcUXUdun1Jr2Kix3xTHQq8sXowQDySyUdJOvmxQAE:cyBUnlnTaVehc23nqBxhTHQ1s4wQ7Aog

Score
10/10
redlineevasioninfostealerpersistencestealertrojan

Malware Config

Targets

    • Target

      f2f68f672b62fc65e343afea6c3e49a2cd43905904eb68de308fcc3bc6d8e3ec.bin

    • Size

      695KB

    • MD5

      48fd845cfc42eb2c4dc4cb03c23b27c8

    • SHA1

      3dc94ca3d3de1979949d0440cdc8103cff8064c6

    • SHA256

      f2f68f672b62fc65e343afea6c3e49a2cd43905904eb68de308fcc3bc6d8e3ec

    • SHA512

      fe3ee9eae6f79dbedea2d4ad6796d678bdae181a6be06c92876d7fc29de6359d907ae330d48727575ae26ea6129f83b5fc3996b04b000e38509f5a64a440af4d

    • SSDEEP

      12288:cy90kUn4MnLH7mFrehcUXUdun1Jr2Kix3xTHQq8sXowQDySyUdJOvmxQAE:cyBUnlnTaVehc23nqBxhTHQ1s4wQ7Aog

    Score
    10/10
    evasionpersistencetrojanredlineinfostealerstealer

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks