Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
JC_98b48f108a619408d7ff503c192a9ca234126e3ef7167a6dcaf26b98c0aa23da
-
Size
830KB
-
Sample
230902-n2wt9ace9z
-
MD5
22f2f2f118e5c873067ec856db7c81a9
-
SHA1
0490839a2fa124ef76c6ae6360150f42dd08e109
-
SHA256
98b48f108a619408d7ff503c192a9ca234126e3ef7167a6dcaf26b98c0aa23da
-
SHA512
470af34f73181631169bca75b837703ac88f71fe924d5cc6b14d3e3cce128b21c259bbe8a97a84fd9da1e2b8c13b3c6928c46c8d068bdec4398143f7bb3cdc33
-
SSDEEP
12288:rMrjy90m7Eid8L6yDGDVDInzwzp+qb9dldDBXRgluSdrx7SnXPnyXJSF4el5xsw:Iyt7hMieziXqHT7SnXPyZExl5Gw
Static task
static1
Behavioral task
behavioral1
Sample
JC_98b48f108a619408d7ff503c192a9ca234126e3ef7167a6dcaf26b98c0aa23da.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
JC_98b48f108a619408d7ff503c192a9ca234126e3ef7167a6dcaf26b98c0aa23da.exe
Resource
win10v2004-20230831-en
Malware Config
Extracted
redline
bobik
77.91.124.82:19071
-
auth_value
d639522ae3c9dda998264d691a19eb33
Targets
-
-
Target
JC_98b48f108a619408d7ff503c192a9ca234126e3ef7167a6dcaf26b98c0aa23da
-
Size
830KB
-
MD5
22f2f2f118e5c873067ec856db7c81a9
-
SHA1
0490839a2fa124ef76c6ae6360150f42dd08e109
-
SHA256
98b48f108a619408d7ff503c192a9ca234126e3ef7167a6dcaf26b98c0aa23da
-
SHA512
470af34f73181631169bca75b837703ac88f71fe924d5cc6b14d3e3cce128b21c259bbe8a97a84fd9da1e2b8c13b3c6928c46c8d068bdec4398143f7bb3cdc33
-
SSDEEP
12288:rMrjy90m7Eid8L6yDGDVDInzwzp+qb9dldDBXRgluSdrx7SnXPnyXJSF4el5xsw:Iyt7hMieziXqHT7SnXPyZExl5Gw
-
Detects Healer an antivirus disabler dropper
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1