Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    007dba05aba21cee2f03f0ff7fe4b7bee8d264354f8cd947c5a2b0ca70e307e7

  • Size

    581KB

  • Sample

    230605-s4f9sshd52

  • MD5

    389d226267d1dfb960beba6228bd2ec6

  • SHA1

    f9a0610c05903d24e707c79f3cf928e587a62049

  • SHA256

    007dba05aba21cee2f03f0ff7fe4b7bee8d264354f8cd947c5a2b0ca70e307e7

  • SHA512

    129a68517e9049c7a18884cf7b76530a0d480bd722d6b9d53b185dc847c697ceee44b96ece593b19d3664d452337cd9c60bd5aa9b20291e6dd566eebd457254f

  • SSDEEP

    12288:5Mriy90iSjE7RNg8js95azbSGVvjZDVphc8d2puDz:TypKuaSb9HVpmkTz

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.126:19048

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Targets

    • Target

      007dba05aba21cee2f03f0ff7fe4b7bee8d264354f8cd947c5a2b0ca70e307e7

    • Size

      581KB

    • MD5

      389d226267d1dfb960beba6228bd2ec6

    • SHA1

      f9a0610c05903d24e707c79f3cf928e587a62049

    • SHA256

      007dba05aba21cee2f03f0ff7fe4b7bee8d264354f8cd947c5a2b0ca70e307e7

    • SHA512

      129a68517e9049c7a18884cf7b76530a0d480bd722d6b9d53b185dc847c697ceee44b96ece593b19d3664d452337cd9c60bd5aa9b20291e6dd566eebd457254f

    • SSDEEP

      12288:5Mriy90iSjE7RNg8js95azbSGVvjZDVphc8d2puDz:TypKuaSb9HVpmkTz

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks