Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    65d5a5c0ba8628ff970366a870ad718cba52418b2037f10c4b4dceaacb7fdd74

  • Size

    479KB

  • Sample

    230508-xcq25sdh9w

  • MD5

    fa2e6676c59225443fc6d79ad4b969fb

  • SHA1

    b962ab9bbda4774d8224529ca97a68c7f70de01b

  • SHA256

    65d5a5c0ba8628ff970366a870ad718cba52418b2037f10c4b4dceaacb7fdd74

  • SHA512

    33543133997d00669a4a60e4b82be2fc2fc041fd935d26371572e8f2d4a8ecf4f79fb35a7a6a958c4c6a22dbc4c231ac4f24b98fbcc4127139dc0bd210552ca8

  • SSDEEP

    12288:mMrJy90HgbRL1p4ZWGCdpKpCItuCfgRrPR:HysgbRL1rMhBfePR

Malware Config

Extracted

Family

redline

Botnet

maher

C2

217.196.96.101:4132

Attributes
  • auth_value

    c57763165f68aabcf4874e661a1ffbac

Targets

    • Target

      65d5a5c0ba8628ff970366a870ad718cba52418b2037f10c4b4dceaacb7fdd74

    • Size

      479KB

    • MD5

      fa2e6676c59225443fc6d79ad4b969fb

    • SHA1

      b962ab9bbda4774d8224529ca97a68c7f70de01b

    • SHA256

      65d5a5c0ba8628ff970366a870ad718cba52418b2037f10c4b4dceaacb7fdd74

    • SHA512

      33543133997d00669a4a60e4b82be2fc2fc041fd935d26371572e8f2d4a8ecf4f79fb35a7a6a958c4c6a22dbc4c231ac4f24b98fbcc4127139dc0bd210552ca8

    • SSDEEP

      12288:mMrJy90HgbRL1p4ZWGCdpKpCItuCfgRrPR:HysgbRL1rMhBfePR

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.