Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    216109af76be0dcc5173bfffcde6f19d.exe

  • Size

    764KB

  • Sample

    230526-sdvz9sge41

  • MD5

    216109af76be0dcc5173bfffcde6f19d

  • SHA1

    c451acb29b897914b3a67a6e83315a0a0c788311

  • SHA256

    0c97a6f4fced09a4eabdaaa2be8ee628aba274ce1e9f6ac219e70d8547f132ff

  • SHA512

    5a5abfefd8f7bec13c693f686a71ad10390a825c0df240f223a9c697c402a4efca03e420051cf1ac5e7a6e3798eee90399b6918160b205937c0954d1792d6969

  • SSDEEP

    12288:WMrxy90DZGPAL4Tvouft6d6S2E59N0CDrWEbgPKII4dBlmdQLBlEd:3y1PFTQVErk0CHWGgi94flmdUG

Malware Config

Extracted

Family

redline

Botnet

misa

C2

83.97.73.122:19062

Attributes
  • auth_value

    9e79529a6bdb4962f44d12b0d6d62d32

Extracted

Family

redline

Botnet

goga

C2

83.97.73.122:19062

Attributes
  • auth_value

    6d57dff6d3c42dddb8a76dc276b8467f

Targets

    • Target

      216109af76be0dcc5173bfffcde6f19d.exe

    • Size

      764KB

    • MD5

      216109af76be0dcc5173bfffcde6f19d

    • SHA1

      c451acb29b897914b3a67a6e83315a0a0c788311

    • SHA256

      0c97a6f4fced09a4eabdaaa2be8ee628aba274ce1e9f6ac219e70d8547f132ff

    • SHA512

      5a5abfefd8f7bec13c693f686a71ad10390a825c0df240f223a9c697c402a4efca03e420051cf1ac5e7a6e3798eee90399b6918160b205937c0954d1792d6969

    • SSDEEP

      12288:WMrxy90DZGPAL4Tvouft6d6S2E59N0CDrWEbgPKII4dBlmdQLBlEd:3y1PFTQVErk0CHWGgi94flmdUG

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks