Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ae2676e481cb0b34416047b97a561f4af0289e7dbb615b3e9a6309b0c01ca803

  • Size

    1.0MB

  • Sample

    230522-xjw7qsca93

  • MD5

    c313f9bf8f8751fcc7476647e49471a7

  • SHA1

    d36fc47c45cb815f4f8773d393ee56905a78118e

  • SHA256

    ae2676e481cb0b34416047b97a561f4af0289e7dbb615b3e9a6309b0c01ca803

  • SHA512

    4a0bf16f6c8b3dd46052b60db68dd94541778fe5a2a7927d84396c24421cd50c45ac5e0a815a74a8eca10da656b40553ecc47de6fc5d81be3f2f84456212d289

  • SSDEEP

    24576:/yD3Vi3IpAqRZrtP8Fvs5+7SEOCNVytWav61wkPsAKFk8:KDFfpVJb7oj+Cs1F

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.122:19524

Attributes
  • auth_value

    6a3f22e5f4209b056a3fd330dc71956a

Targets

    • Target

      ae2676e481cb0b34416047b97a561f4af0289e7dbb615b3e9a6309b0c01ca803

    • Size

      1.0MB

    • MD5

      c313f9bf8f8751fcc7476647e49471a7

    • SHA1

      d36fc47c45cb815f4f8773d393ee56905a78118e

    • SHA256

      ae2676e481cb0b34416047b97a561f4af0289e7dbb615b3e9a6309b0c01ca803

    • SHA512

      4a0bf16f6c8b3dd46052b60db68dd94541778fe5a2a7927d84396c24421cd50c45ac5e0a815a74a8eca10da656b40553ecc47de6fc5d81be3f2f84456212d289

    • SSDEEP

      24576:/yD3Vi3IpAqRZrtP8Fvs5+7SEOCNVytWav61wkPsAKFk8:KDFfpVJb7oj+Cs1F

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks