Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a6dc001178b86faabb5eed1d9086b780d903e6e7752dd6017cd9bd650a97870d
-
Size
560KB
-
Sample
230804-15xl6sfh6v
-
MD5
dcc6ddc958b4487a5681c9849fa13159
-
SHA1
d4e71015f3101e84b5064779919438c36fdea40b
-
SHA256
a6dc001178b86faabb5eed1d9086b780d903e6e7752dd6017cd9bd650a97870d
-
SHA512
85c50aea35519842a10b133ae4d5ffc195375963543dc970b3489ff427db93af7dd33ec34c7d1256ce9a9a8400c2fb01f309bdb6e42589924871bd7d6ace4409
-
SSDEEP
12288:UMrGy90PaoR1L4NYJYQ3Og/gbaUoyaBgiBus9FqSNZ:Ky8p4Q8eUoyyg7UES
Static task
static1
Behavioral task
behavioral1
Sample
a6dc001178b86faabb5eed1d9086b780d903e6e7752dd6017cd9bd650a97870d.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
amadey
3.87
193.233.255.9/nasa/index.php
Extracted
redline
micky
77.91.124.172:19071
-
auth_value
748f3c67c004f4a994500f05127b4428
Targets
-
-
Target
a6dc001178b86faabb5eed1d9086b780d903e6e7752dd6017cd9bd650a97870d
-
Size
560KB
-
MD5
dcc6ddc958b4487a5681c9849fa13159
-
SHA1
d4e71015f3101e84b5064779919438c36fdea40b
-
SHA256
a6dc001178b86faabb5eed1d9086b780d903e6e7752dd6017cd9bd650a97870d
-
SHA512
85c50aea35519842a10b133ae4d5ffc195375963543dc970b3489ff427db93af7dd33ec34c7d1256ce9a9a8400c2fb01f309bdb6e42589924871bd7d6ace4409
-
SSDEEP
12288:UMrGy90PaoR1L4NYJYQ3Og/gbaUoyaBgiBus9FqSNZ:Ky8p4Q8eUoyyg7UES
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1