Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2725bce2a2922e12a71f26ec84a38447c569656ee22da50f30b450eea68016ec.bin

  • Size

    1.2MB

  • Sample

    230506-zvs1kagb9y

  • MD5

    08ee060138f01d40a4ab5a1511594fb3

  • SHA1

    a973febb5f8ee0cd296d5d40a57ce8ea5aeb865a

  • SHA256

    2725bce2a2922e12a71f26ec84a38447c569656ee22da50f30b450eea68016ec

  • SHA512

    5ccec5d8b3e7333418003255ab8ef52b77bae68eaded73246e2eb23e43523e38580b7bed5eb2235d2da21935e1f3e39ce92891dfc67dd727e446f221f0cb03ed

  • SSDEEP

    24576:nu0fRlKB2ZGPoUC1VqAUjfeEB7htX0yromAWB5HpS/gl:u0+BshUC1VzUjjPP0/

Malware Config

Targets

    • Target

      2725bce2a2922e12a71f26ec84a38447c569656ee22da50f30b450eea68016ec.bin

    • Size

      1.2MB

    • MD5

      08ee060138f01d40a4ab5a1511594fb3

    • SHA1

      a973febb5f8ee0cd296d5d40a57ce8ea5aeb865a

    • SHA256

      2725bce2a2922e12a71f26ec84a38447c569656ee22da50f30b450eea68016ec

    • SHA512

      5ccec5d8b3e7333418003255ab8ef52b77bae68eaded73246e2eb23e43523e38580b7bed5eb2235d2da21935e1f3e39ce92891dfc67dd727e446f221f0cb03ed

    • SSDEEP

      24576:nu0fRlKB2ZGPoUC1VqAUjfeEB7htX0yromAWB5HpS/gl:u0+BshUC1VzUjjPP0/

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks