Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ee65d017c265ab9a8e06dcd97f158edad93fc27f5650917d8c5eee735633acd3

  • Size

    766KB

  • Sample

    230525-xg45kabg75

  • MD5

    111f0b3c5f6af70c4ec9c56fda83d7b1

  • SHA1

    2972ab1e9152143697e36922a5a191993b0fabc4

  • SHA256

    ee65d017c265ab9a8e06dcd97f158edad93fc27f5650917d8c5eee735633acd3

  • SHA512

    260a96326c8fb159d0aff30947a7a781992563f50e8ee680184e583bb15dd901128897215bbb382e13efd586efac29f8d0e7f551508efce668e672652574b74f

  • SSDEEP

    12288:XMr3y90nFUWywLylG1Jfzr+6Itsr3vQRm3fc1RmWIArWbUI6FLvGkBkunM8tIW+G:wyqUjlG7P24e00RmWIAad6RukiuM81+G

Malware Config

Extracted

Family

redline

Botnet

dina

C2

83.97.73.122:19062

Attributes
  • auth_value

    4f77073adc624269de1bff760b9bc471

Extracted

Family

redline

Botnet

greg

C2

83.97.73.122:19062

Attributes
  • auth_value

    4c966a90781c6b4ab7f512d018696362

Targets

    • Target

      ee65d017c265ab9a8e06dcd97f158edad93fc27f5650917d8c5eee735633acd3

    • Size

      766KB

    • MD5

      111f0b3c5f6af70c4ec9c56fda83d7b1

    • SHA1

      2972ab1e9152143697e36922a5a191993b0fabc4

    • SHA256

      ee65d017c265ab9a8e06dcd97f158edad93fc27f5650917d8c5eee735633acd3

    • SHA512

      260a96326c8fb159d0aff30947a7a781992563f50e8ee680184e583bb15dd901128897215bbb382e13efd586efac29f8d0e7f551508efce668e672652574b74f

    • SSDEEP

      12288:XMr3y90nFUWywLylG1Jfzr+6Itsr3vQRm3fc1RmWIArWbUI6FLvGkBkunM8tIW+G:wyqUjlG7P24e00RmWIAad6RukiuM81+G

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks