Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    53c5e42f93ad280c6af692a6c2aaec59dabd21bcbb4ee4ca665ee15ad1676063.bin

  • Size

    1.7MB

  • Sample

    230506-1t4lcaaa88

  • MD5

    242801d705fc7e3455ec8e83d4152c31

  • SHA1

    fffdfc9d9f2d4b076d6a0d629c18abdc71077659

  • SHA256

    53c5e42f93ad280c6af692a6c2aaec59dabd21bcbb4ee4ca665ee15ad1676063

  • SHA512

    31bb345823f9ee6f78987137e49996c214cb2e53731f63eacdcf5037689f3f7202735daa6d62356f06f2170d034b25694bb84d0d1b4de4a552e2a0fc45f06588

  • SSDEEP

    24576:oyZBOnzNHgrUpXZi0VnVn4ZmrStXxWgpnCzL6GB7v5FkAHkj8BVIqhTIacUH2Kg6:vZUnJOgXSmOtBnng6sAAH63m3TpuOi

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Targets

    • Target

      53c5e42f93ad280c6af692a6c2aaec59dabd21bcbb4ee4ca665ee15ad1676063.bin

    • Size

      1.7MB

    • MD5

      242801d705fc7e3455ec8e83d4152c31

    • SHA1

      fffdfc9d9f2d4b076d6a0d629c18abdc71077659

    • SHA256

      53c5e42f93ad280c6af692a6c2aaec59dabd21bcbb4ee4ca665ee15ad1676063

    • SHA512

      31bb345823f9ee6f78987137e49996c214cb2e53731f63eacdcf5037689f3f7202735daa6d62356f06f2170d034b25694bb84d0d1b4de4a552e2a0fc45f06588

    • SSDEEP

      24576:oyZBOnzNHgrUpXZi0VnVn4ZmrStXxWgpnCzL6GB7v5FkAHkj8BVIqhTIacUH2Kg6:vZUnJOgXSmOtBnng6sAAH63m3TpuOi

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks