Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    72f3f8550c3f64ebda9f920f308d24a8c371c0246d0c4768f9fceee021565dc9

  • Size

    768KB

  • Sample

    230526-gyb74sea97

  • MD5

    e33d44f2601164dd4462aa14a84858fb

  • SHA1

    4f969ee7d62b0bea719e773d16a6e29cbf8e9d9c

  • SHA256

    72f3f8550c3f64ebda9f920f308d24a8c371c0246d0c4768f9fceee021565dc9

  • SHA512

    e89cdd7eb024d8603d6721a61bff0e42ab6f1cedecaca33a4563ae54173f65cdea69a57e65a4f4ae214ce27f5d94bba21ec25feb91409be7f4f970fc6fcde933

  • SSDEEP

    12288:NMrky90xAGd1fezFAFpLq2tMtfGRJIr8K2n2ylUl6z9Wn0kBiinMLtIW+BEWJkY:Jy+L1fezqFpW2tMtfGR6mnUlM80k4iMm

Malware Config

Extracted

Family

redline

Botnet

dina

C2

83.97.73.122:19062

Attributes
  • auth_value

    4f77073adc624269de1bff760b9bc471

Extracted

Family

redline

Botnet

greg

C2

83.97.73.122:19062

Attributes
  • auth_value

    4c966a90781c6b4ab7f512d018696362

Targets

    • Target

      72f3f8550c3f64ebda9f920f308d24a8c371c0246d0c4768f9fceee021565dc9

    • Size

      768KB

    • MD5

      e33d44f2601164dd4462aa14a84858fb

    • SHA1

      4f969ee7d62b0bea719e773d16a6e29cbf8e9d9c

    • SHA256

      72f3f8550c3f64ebda9f920f308d24a8c371c0246d0c4768f9fceee021565dc9

    • SHA512

      e89cdd7eb024d8603d6721a61bff0e42ab6f1cedecaca33a4563ae54173f65cdea69a57e65a4f4ae214ce27f5d94bba21ec25feb91409be7f4f970fc6fcde933

    • SSDEEP

      12288:NMrky90xAGd1fezFAFpLq2tMtfGRJIr8K2n2ylUl6z9Wn0kBiinMLtIW+BEWJkY:Jy+L1fezqFpW2tMtfGR6mnUlM80k4iMm

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks