Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
664c16bc42dde4a5662314b15bc05609.exe
-
Size
559KB
-
Sample
230803-z4f3cshd3t
-
MD5
664c16bc42dde4a5662314b15bc05609
-
SHA1
ba5345e96de6afde838b500943998a8cc6fa1fec
-
SHA256
9e1a977f3db2ef35b86d3cdc89b7cc366ad93c6648db0ba80defaacb3aabe90f
-
SHA512
b07f28c17e1ed8aed1de54d8a6beebd0ce6d905e941c29e8b5b240f0acab7c307a148346dbed495e231e25ea235bd55efea5665c5e1a79646fd1e097e4a15cf4
-
SSDEEP
12288:UMrIy9010SQL/W4EFc0MlL7K2zyYlgi1jzH6uq/vR0UP:cyw01L/Etu/K2yggojzHyHR0UP
Static task
static1
Behavioral task
behavioral1
Sample
664c16bc42dde4a5662314b15bc05609.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
664c16bc42dde4a5662314b15bc05609.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
amadey
3.87
193.233.255.9/nasa/index.php
Extracted
redline
maxik
77.91.124.156:19071
-
auth_value
a7714e1bc167c67e3fc8f9e368352269
Targets
-
-
Target
664c16bc42dde4a5662314b15bc05609.exe
-
Size
559KB
-
MD5
664c16bc42dde4a5662314b15bc05609
-
SHA1
ba5345e96de6afde838b500943998a8cc6fa1fec
-
SHA256
9e1a977f3db2ef35b86d3cdc89b7cc366ad93c6648db0ba80defaacb3aabe90f
-
SHA512
b07f28c17e1ed8aed1de54d8a6beebd0ce6d905e941c29e8b5b240f0acab7c307a148346dbed495e231e25ea235bd55efea5665c5e1a79646fd1e097e4a15cf4
-
SSDEEP
12288:UMrIy9010SQL/W4EFc0MlL7K2zyYlgi1jzH6uq/vR0UP:cyw01L/Etu/K2yggojzHyHR0UP
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1