Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0c16adf574337009ba84419e2681cef81612e0e3d87e93a213dfce55a9fdd4dc

  • Size

    1.0MB

  • Sample

    230521-shtyrsde7x

  • MD5

    448be7ee03498f73177b00c17bf3850d

  • SHA1

    aef616aa997716e773dd372248533f67d3bb81a4

  • SHA256

    0c16adf574337009ba84419e2681cef81612e0e3d87e93a213dfce55a9fdd4dc

  • SHA512

    112dee042f4582f6c1ffff1e167fda2a1056dbfe56428add96662bc37ea482e9537664059747bf62d18604774fa23c80f0455622b4e3d3119917800ca316540d

  • SSDEEP

    24576:MyELuYfB1lKlNmM0mnZ/OIQf7WIKrCgXlzqDP8pqlv:7SfB1lKB0mncI27hKGKSkc

Malware Config

Extracted

Family

redline

Botnet

diza

C2

185.161.248.37:4138

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Targets

    • Target

      0c16adf574337009ba84419e2681cef81612e0e3d87e93a213dfce55a9fdd4dc

    • Size

      1.0MB

    • MD5

      448be7ee03498f73177b00c17bf3850d

    • SHA1

      aef616aa997716e773dd372248533f67d3bb81a4

    • SHA256

      0c16adf574337009ba84419e2681cef81612e0e3d87e93a213dfce55a9fdd4dc

    • SHA512

      112dee042f4582f6c1ffff1e167fda2a1056dbfe56428add96662bc37ea482e9537664059747bf62d18604774fa23c80f0455622b4e3d3119917800ca316540d

    • SSDEEP

      24576:MyELuYfB1lKlNmM0mnZ/OIQf7WIKrCgXlzqDP8pqlv:7SfB1lKB0mncI27hKGKSkc

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks