Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    8ff3fc6f89e6f596cbaf69ed3fcc7fa2.exe

  • Size

    1.0MB

  • Sample

    230518-1hb2ysch41

  • MD5

    8ff3fc6f89e6f596cbaf69ed3fcc7fa2

  • SHA1

    83e3c650c4b1a2a41900e26a01f62dfd681db8b2

  • SHA256

    2fe6e3f3ef4455d0ab3051d04634c7762965b4decd50e3209e0f9ec099b54ac5

  • SHA512

    387239807059c928e2549cdab2ca141bf17dcf375ce9bee8fe2a47d0aa057943a1ef5ac4098ec2a8345c6403d1c7959212c7034bcc8db271fb558c54fa28ffb4

  • SSDEEP

    24576:TydYAqQngfctE4oswpYKCZUyRRfYqTHB2vE9:m+AqQSElUdXeRfYwYE

Malware Config

Extracted

Family

redline

Botnet

dako

C2

77.91.68.253:41783

Attributes
  • auth_value

    c6bc6a7edb74e0eff37800710e07bee1

Targets

    • Target

      8ff3fc6f89e6f596cbaf69ed3fcc7fa2.exe

    • Size

      1.0MB

    • MD5

      8ff3fc6f89e6f596cbaf69ed3fcc7fa2

    • SHA1

      83e3c650c4b1a2a41900e26a01f62dfd681db8b2

    • SHA256

      2fe6e3f3ef4455d0ab3051d04634c7762965b4decd50e3209e0f9ec099b54ac5

    • SHA512

      387239807059c928e2549cdab2ca141bf17dcf375ce9bee8fe2a47d0aa057943a1ef5ac4098ec2a8345c6403d1c7959212c7034bcc8db271fb558c54fa28ffb4

    • SSDEEP

      24576:TydYAqQngfctE4oswpYKCZUyRRfYqTHB2vE9:m+AqQSElUdXeRfYwYE

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks