Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4513016ed9b9a7e7fef4b364cb372dc4.bin

  • Size

    686KB

  • Sample

    230602-bskpeahf6t

  • MD5

    2bd8b27e341d6d9f66ea0800ea403b06

  • SHA1

    c32d2d50c5e9579aae27a5bec78c86f21e5ff446

  • SHA256

    fcb4b2bf2718b4a2b783a59ceaadf093a2aa88055a777d3e739216d688a68e1f

  • SHA512

    68e8b05e16e5c31d21ca4ff09560fc7ca4d9c7c843587c39fa3f290da22cf1a1780778b1e67f53f7c900dded8cac291a991b79c099cc70073fba6786340ae970

  • SSDEEP

    12288:XAGCDY6iJsAeDY8by49gzbVoHr6cKfXK2Fpluq+9U7uZp/3yeDnB:XAHY6i7i59gzmrxyXK2nYJ9ouX7DnB

Malware Config

Extracted

Family

redline

Botnet

mars

C2

83.97.73.127:19045

Attributes
  • auth_value

    91bd3682cfb50cdc64b6009eb977b766

Extracted

Family

redline

Botnet

nitro

C2

83.97.73.127:19045

Attributes
  • auth_value

    1b68cf84b9b046f28b71cb39e44aa0e4

Targets

    • Target

      b5eca4cbd012265d341116ee6de9ca4d1a951a55e3d31145b0d0d887497619f7.exe

    • Size

      729KB

    • MD5

      4513016ed9b9a7e7fef4b364cb372dc4

    • SHA1

      0a855045deb6ae4cf287c1a06fd7a38f36001107

    • SHA256

      b5eca4cbd012265d341116ee6de9ca4d1a951a55e3d31145b0d0d887497619f7

    • SHA512

      d44dcf6eb1ebb1b4724880127e5b81474ba706f000cce7a3bed31b3be99c213b2ba4968f6d2248c6dc41c8ee60e57532871dbe6337f5a314ac876bf3e1ba5e80

    • SSDEEP

      12288:sMrtTy90Ex8pJyI0fQnzXRt1KL4xnzkYWN7SwKw7H7Zu8OEstR:pyXxYyI0fQnzrPxzQnKsHtuBLj

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks