Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77

  • Size

    389KB

  • Sample

    230720-sdlrlahb63

  • MD5

    a7b11d69d97cc765f11a42cd44464f05

  • SHA1

    5a8f7af21f617e81d3d2f47b76ced3d7edb15681

  • SHA256

    d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77

  • SHA512

    436e936007def7fb84ed60d0258feb9c053479891d19eb640357ff3853c9987d757b153d26ab8d326776def54c274a8dff24af44da85e44a644aaae5b0607bc0

  • SSDEEP

    6144:Kgy+bnr+5p0yN90QEB9k3vBt6mHDQvgB4ikaVIIhX3dMfiHwG6iE0WCzIb0p:EMr5y90Jkfv6mHEvo4ikh8nUij6iPgm

Malware Config

Extracted

Family

redline

Botnet

nasa

C2

77.91.68.68:19071

Attributes
  • auth_value

    6da71218d8a9738ea3a9a78b5677589b

Targets

    • Target

      d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77

    • Size

      389KB

    • MD5

      a7b11d69d97cc765f11a42cd44464f05

    • SHA1

      5a8f7af21f617e81d3d2f47b76ced3d7edb15681

    • SHA256

      d7fe1a24eb072e1dbf449007765aa3c151957dfd2493759d63f6c46c8e28ea77

    • SHA512

      436e936007def7fb84ed60d0258feb9c053479891d19eb640357ff3853c9987d757b153d26ab8d326776def54c274a8dff24af44da85e44a644aaae5b0607bc0

    • SSDEEP

      6144:Kgy+bnr+5p0yN90QEB9k3vBt6mHDQvgB4ikaVIIhX3dMfiHwG6iE0WCzIb0p:EMr5y90Jkfv6mHEvo4ikh8nUij6iPgm

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks