Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
76537f3c5d30630340cfc90e4942a8e1c242d2e2bf36195d0b2856ea1a6dd67a
-
Size
556KB
-
Sample
230808-faq6pacb51
-
MD5
c8446b3b869f1d83d5ea1ab24bf8fc6b
-
SHA1
34c7b296611c27d8b8d919ce901ea973680ecbba
-
SHA256
76537f3c5d30630340cfc90e4942a8e1c242d2e2bf36195d0b2856ea1a6dd67a
-
SHA512
9efb7076b13d4b5cf49c91aa54c10c9483b9205427fcc36ce1589f9127dae404c0be0a80e6e16c4cb9783ef836520639b94488f7eb844e953eb58f778242afe2
-
SSDEEP
12288:0MrGy90MAteQatK3Wpgpj1rv43gBYCmtBT4mWJJXDkQYh:aySt+IGg1rvhzW4mWDTkQk
Static task
static1
Behavioral task
behavioral1
Sample
76537f3c5d30630340cfc90e4942a8e1c242d2e2bf36195d0b2856ea1a6dd67a.exe
Resource
win10-20230703-en
Malware Config
Extracted
amadey
3.86
77.91.68.61/rock/index.php
Extracted
redline
dodge
77.91.124.156:19071
-
auth_value
3372223e987be2a16148c072df30163d
Targets
-
-
Target
76537f3c5d30630340cfc90e4942a8e1c242d2e2bf36195d0b2856ea1a6dd67a
-
Size
556KB
-
MD5
c8446b3b869f1d83d5ea1ab24bf8fc6b
-
SHA1
34c7b296611c27d8b8d919ce901ea973680ecbba
-
SHA256
76537f3c5d30630340cfc90e4942a8e1c242d2e2bf36195d0b2856ea1a6dd67a
-
SHA512
9efb7076b13d4b5cf49c91aa54c10c9483b9205427fcc36ce1589f9127dae404c0be0a80e6e16c4cb9783ef836520639b94488f7eb844e953eb58f778242afe2
-
SSDEEP
12288:0MrGy90MAteQatK3Wpgpj1rv43gBYCmtBT4mWJJXDkQYh:aySt+IGg1rvhzW4mWDTkQk
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1