Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0b003ea93f02d7c174a76735ef668bcc053a389349e23b1cb17b97cb579ec1a5

  • Size

    479KB

  • Sample

    230507-s3g5psfb26

  • MD5

    98e5c36363291d62003d3ab32cf98d22

  • SHA1

    9cfcebcacfb959b9b04d69dc0ad6f924c356514e

  • SHA256

    0b003ea93f02d7c174a76735ef668bcc053a389349e23b1cb17b97cb579ec1a5

  • SHA512

    1540aab5940afc20905c0d2452428308524385d1dba1e136f56faec18bdec4cdaa5a98084722876c92a43b4edd7e57423483cbb7cf2782b14fb3ec7649436910

  • SSDEEP

    12288:ZMrCy90/hWC6GrNN8L8ZVWAwx0tTzlwSrk0f:/y8t6Gra8sxeT5nB

Malware Config

Extracted

Family

redline

Botnet

domor

C2

217.196.96.101:4132

Attributes
  • auth_value

    39471bda00546bb0435bc7adfd6881dc

Targets

    • Target

      0b003ea93f02d7c174a76735ef668bcc053a389349e23b1cb17b97cb579ec1a5

    • Size

      479KB

    • MD5

      98e5c36363291d62003d3ab32cf98d22

    • SHA1

      9cfcebcacfb959b9b04d69dc0ad6f924c356514e

    • SHA256

      0b003ea93f02d7c174a76735ef668bcc053a389349e23b1cb17b97cb579ec1a5

    • SHA512

      1540aab5940afc20905c0d2452428308524385d1dba1e136f56faec18bdec4cdaa5a98084722876c92a43b4edd7e57423483cbb7cf2782b14fb3ec7649436910

    • SSDEEP

      12288:ZMrCy90/hWC6GrNN8L8ZVWAwx0tTzlwSrk0f:/y8t6Gra8sxeT5nB

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks