Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    db0b7a732839ca79d4c732e142a729cd11ea4ecf5158f273b9badbb7294ba49b

  • Size

    730KB

  • Sample

    230531-gxs48sdc23

  • MD5

    328f138f677a7246e5a030541aa3ea83

  • SHA1

    4152422ffcdaaf953b73f9cab4a7c006b17011f7

  • SHA256

    db0b7a732839ca79d4c732e142a729cd11ea4ecf5158f273b9badbb7294ba49b

  • SHA512

    e2c31f2a819c502b9885993a9b7458d300ca3acc675bc16f025666a05951352c31c08ad37be7596109d27e5beaa6d9a89f23e7fa498025541f108e16461bc4b9

  • SSDEEP

    12288:oMroy90mCku407Cqbduz8FEc2xfd/rTi5TMPnurAvCVAvnx6WOazfth:gyRDQe0EcgrTi5kurAvCVenfX

Malware Config

Extracted

Family

redline

Botnet

musa

C2

83.97.73.127:19045

Attributes
  • auth_value

    745cd242a52ab79c9c9026155d62f359

Extracted

Family

redline

Botnet

tinda

C2

83.97.73.127:19045

Attributes
  • auth_value

    88da3924455f4ba3a1b76cd03af918bb

Targets

    • Target

      db0b7a732839ca79d4c732e142a729cd11ea4ecf5158f273b9badbb7294ba49b

    • Size

      730KB

    • MD5

      328f138f677a7246e5a030541aa3ea83

    • SHA1

      4152422ffcdaaf953b73f9cab4a7c006b17011f7

    • SHA256

      db0b7a732839ca79d4c732e142a729cd11ea4ecf5158f273b9badbb7294ba49b

    • SHA512

      e2c31f2a819c502b9885993a9b7458d300ca3acc675bc16f025666a05951352c31c08ad37be7596109d27e5beaa6d9a89f23e7fa498025541f108e16461bc4b9

    • SSDEEP

      12288:oMroy90mCku407Cqbduz8FEc2xfd/rTi5TMPnurAvCVAvnx6WOazfth:gyRDQe0EcgrTi5kurAvCVenfX

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.