Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    9bf5708f2c35cb530300c17a457d15ab392021d6f2678ddd9328e1b28cf90762

  • Size

    751KB

  • Sample

    230531-wchv4agh21

  • MD5

    bbeda25b384fd4903c2c4f58c7d90d79

  • SHA1

    b6d65776c0fe423ced09196e6b5b6f1b991878ff

  • SHA256

    9bf5708f2c35cb530300c17a457d15ab392021d6f2678ddd9328e1b28cf90762

  • SHA512

    461d5d2658d10683956e258c944e244aab2a546e5aac7cc03c0f64e81b717ff1ec118fc36d4cf81d5dad02df43c76cefc7306444ee8e3a44e596f2c4ae94c75a

  • SSDEEP

    12288:HMrVy9039+gOyL3VRubcngLVJQK/gyoICLb39x6ugAtwyfoyZw5TRWQcfxnZ:ey4XOuR7nSQIIz6goyocZfxZ

Malware Config

Extracted

Family

redline

Botnet

mars

C2

83.97.73.127:19045

Attributes
  • auth_value

    91bd3682cfb50cdc64b6009eb977b766

Extracted

Family

redline

Botnet

nitro

C2

83.97.73.127:19045

Attributes
  • auth_value

    1b68cf84b9b046f28b71cb39e44aa0e4

Targets

    • Target

      9bf5708f2c35cb530300c17a457d15ab392021d6f2678ddd9328e1b28cf90762

    • Size

      751KB

    • MD5

      bbeda25b384fd4903c2c4f58c7d90d79

    • SHA1

      b6d65776c0fe423ced09196e6b5b6f1b991878ff

    • SHA256

      9bf5708f2c35cb530300c17a457d15ab392021d6f2678ddd9328e1b28cf90762

    • SHA512

      461d5d2658d10683956e258c944e244aab2a546e5aac7cc03c0f64e81b717ff1ec118fc36d4cf81d5dad02df43c76cefc7306444ee8e3a44e596f2c4ae94c75a

    • SSDEEP

      12288:HMrVy9039+gOyL3VRubcngLVJQK/gyoICLb39x6ugAtwyfoyZw5TRWQcfxnZ:ey4XOuR7nSQIIz6goyocZfxZ

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.