Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b

  • Size

    872KB

  • Sample

    230524-mjl2nacf4x

  • MD5

    c49efa26968f3fd42e137fc67165627e

  • SHA1

    20f9a5cdc2a18b3f8547a96529e46a458e3e0596

  • SHA256

    d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b

  • SHA512

    6583197391fe879a311d0f31d967c3b29362fc7a236ab42b67d58d542405d454e6173fa67681fa99d7dbafe303cfc3c9b4dcba6b9f47f95566371b39a30b3ca7

  • SSDEEP

    12288:AMrwy900EgqYwKha9isr3ueSVeovoitevqkBImOu3YpnmMUo02GnQK09:AynEiNh6Zr3PioqBmOu3qbcQb9

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.122:19062

Attributes
  • auth_value

    6a3f22e5f4209b056a3fd330dc71956a

Extracted

Family

redline

Botnet

mesu

C2

83.97.73.122:19062

Attributes
  • auth_value

    8ede6a157d1d9509a21427d10e999ba2

Targets

    • Target

      d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b

    • Size

      872KB

    • MD5

      c49efa26968f3fd42e137fc67165627e

    • SHA1

      20f9a5cdc2a18b3f8547a96529e46a458e3e0596

    • SHA256

      d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b

    • SHA512

      6583197391fe879a311d0f31d967c3b29362fc7a236ab42b67d58d542405d454e6173fa67681fa99d7dbafe303cfc3c9b4dcba6b9f47f95566371b39a30b3ca7

    • SSDEEP

      12288:AMrwy900EgqYwKha9isr3ueSVeovoitevqkBImOu3YpnmMUo02GnQK09:AynEiNh6Zr3PioqBmOu3qbcQb9

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks