Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a3f5843f9d7371cafdff8ae2a74986fd2ff3a5309b5145d720ce3a9ce731d55f

  • Size

    479KB

  • Sample

    230510-eldt3agb3y

  • MD5

    a102e3deacf5f85a7a34a64ffe4f2932

  • SHA1

    c3de62f61ad2a94c6ae792cd6e19f23eaaeaac26

  • SHA256

    a3f5843f9d7371cafdff8ae2a74986fd2ff3a5309b5145d720ce3a9ce731d55f

  • SHA512

    291ded56a0769536fd9ac67fc45696f03dd2f5a7ce95b7af49ec08b7c10509a49d13b9b327499273d7ce7d60c9f2f6d63288bccb442516aad0db8d13198172fe

  • SSDEEP

    12288:lMrgy90wLrKFETn9l5IqIW9GolqLlbdXIHDDyNaAs:lyvLp9l5XxMhhXkny/s

Malware Config

Extracted

Family

redline

Botnet

divan

C2

217.196.96.102:4132

Attributes
  • auth_value

    b414986bebd7f5a3ec9aee0341b8e769

Targets

    • Target

      a3f5843f9d7371cafdff8ae2a74986fd2ff3a5309b5145d720ce3a9ce731d55f

    • Size

      479KB

    • MD5

      a102e3deacf5f85a7a34a64ffe4f2932

    • SHA1

      c3de62f61ad2a94c6ae792cd6e19f23eaaeaac26

    • SHA256

      a3f5843f9d7371cafdff8ae2a74986fd2ff3a5309b5145d720ce3a9ce731d55f

    • SHA512

      291ded56a0769536fd9ac67fc45696f03dd2f5a7ce95b7af49ec08b7c10509a49d13b9b327499273d7ce7d60c9f2f6d63288bccb442516aad0db8d13198172fe

    • SSDEEP

      12288:lMrgy90wLrKFETn9l5IqIW9GolqLlbdXIHDDyNaAs:lyvLp9l5XxMhhXkny/s

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks