Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4436621650402114ba36dd141e9d52ef5dd0ecf42727fbe7843b6b01f2ac990a

  • Size

    1.0MB

  • Sample

    230519-wa899shg7t

  • MD5

    00eb280242272782a7d9ce7f9e666148

  • SHA1

    16d1d1076613f3aefa73d27fc44caa370220e951

  • SHA256

    4436621650402114ba36dd141e9d52ef5dd0ecf42727fbe7843b6b01f2ac990a

  • SHA512

    288c8ae7ea127570b86fbae97a9425f3f415a72f8bb84152da2e72e2e4a5aeec4449f91bfe7a4a8617abf5d29466b7f335bb1b6d8ab075ffba64d094b1f3d0c9

  • SSDEEP

    24576:+yIVGtkp9xZT+/hJqNDG0yZqQg4d66c3MVU5IL:NVOwvaDyZmzMVU5

Malware Config

Extracted

Family

redline

Botnet

duper

C2

77.91.68.253:19065

Attributes
  • auth_value

    57e17ebbdb18f4882b95fe05402ef1c8

Targets

    • Target

      4436621650402114ba36dd141e9d52ef5dd0ecf42727fbe7843b6b01f2ac990a

    • Size

      1.0MB

    • MD5

      00eb280242272782a7d9ce7f9e666148

    • SHA1

      16d1d1076613f3aefa73d27fc44caa370220e951

    • SHA256

      4436621650402114ba36dd141e9d52ef5dd0ecf42727fbe7843b6b01f2ac990a

    • SHA512

      288c8ae7ea127570b86fbae97a9425f3f415a72f8bb84152da2e72e2e4a5aeec4449f91bfe7a4a8617abf5d29466b7f335bb1b6d8ab075ffba64d094b1f3d0c9

    • SSDEEP

      24576:+yIVGtkp9xZT+/hJqNDG0yZqQg4d66c3MVU5IL:NVOwvaDyZmzMVU5

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks