Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    bcd455a2571aa40d1a91431e5e7bf6fb9ee479c6efbd4f9437d1ab55f0996e8e

  • Size

    1.0MB

  • Sample

    230518-cg7v8sgd6s

  • MD5

    472eff4dde9545a0ab39c54817ff7453

  • SHA1

    a68e963c28d85b98c57cd94a1171252265a0b67c

  • SHA256

    bcd455a2571aa40d1a91431e5e7bf6fb9ee479c6efbd4f9437d1ab55f0996e8e

  • SHA512

    a9fa61ebebb9b0f5d277d47f80824d6ad824916cf598c9142775b7e4e0b8e0e2db33269eed0f853b78f9a511ceb447d8c7b351df116e6a9bdeb1f86857985868

  • SSDEEP

    24576:MyNxW1Bobt8uiImN9JvuLDp+QiHg25Im2ZTJIth4TfX/PqT3XQ:7Nmct88m7Jgp+Qm55OLIt6TfXnS

Malware Config

Extracted

Family

redline

Botnet

dream

C2

77.91.68.253:4138

Attributes
  • auth_value

    7b4f26a4ca794e30cee1032d5cb62f5c

Targets

    • Target

      bcd455a2571aa40d1a91431e5e7bf6fb9ee479c6efbd4f9437d1ab55f0996e8e

    • Size

      1.0MB

    • MD5

      472eff4dde9545a0ab39c54817ff7453

    • SHA1

      a68e963c28d85b98c57cd94a1171252265a0b67c

    • SHA256

      bcd455a2571aa40d1a91431e5e7bf6fb9ee479c6efbd4f9437d1ab55f0996e8e

    • SHA512

      a9fa61ebebb9b0f5d277d47f80824d6ad824916cf598c9142775b7e4e0b8e0e2db33269eed0f853b78f9a511ceb447d8c7b351df116e6a9bdeb1f86857985868

    • SSDEEP

      24576:MyNxW1Bobt8uiImN9JvuLDp+QiHg25Im2ZTJIth4TfX/PqT3XQ:7Nmct88m7Jgp+Qm55OLIt6TfXnS

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.