Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Startup669.exe

  • Size

    1.0MB

  • Sample

    230521-r62svaaf94

  • MD5

    c8687c2885d69099e0dd98a1dd00dd15

  • SHA1

    250ff357e88142e458b92620df12211027ce40b9

  • SHA256

    ab9f636f5bb2df81e6305d6bccdd1b97e260350079983d0c3a184d0769f1a3f5

  • SHA512

    2ce35ce6eff17a27e34259b3d02094288edde4dd63401531206c0cc13333aa47c55a4fd6906ab1cd80df9715bf1f0b20586c98c801c6047f0b61422c78499537

  • SSDEEP

    24576:DyIDtDvlYQNDDqqOowSLG77yhh1hdFPDN3DoJb4vfg3:WIDtR9NDDqqNl672hhN3DolUfg

Malware Config

Extracted

Family

redline

Botnet

mixa

C2

185.161.248.37:4138

Attributes
  • auth_value

    9d14534b25ac495ab25b59800acf3bb2

Targets

    • Target

      Startup669.exe

    • Size

      1.0MB

    • MD5

      c8687c2885d69099e0dd98a1dd00dd15

    • SHA1

      250ff357e88142e458b92620df12211027ce40b9

    • SHA256

      ab9f636f5bb2df81e6305d6bccdd1b97e260350079983d0c3a184d0769f1a3f5

    • SHA512

      2ce35ce6eff17a27e34259b3d02094288edde4dd63401531206c0cc13333aa47c55a4fd6906ab1cd80df9715bf1f0b20586c98c801c6047f0b61422c78499537

    • SSDEEP

      24576:DyIDtDvlYQNDDqqOowSLG77yhh1hdFPDN3DoJb4vfg3:WIDtR9NDDqqNl672hhN3DolUfg

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks