Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0ccdaa4b3990bcf4745acfd0ef34da97e2a8734aaa88d6b9b6bbf6b7750630e1

  • Size

    1.2MB

  • Sample

    231013-c74aqsda58

  • MD5

    52b8c6aca612750f0732e58b42e9db9e

  • SHA1

    2acc3ab9792418c585a67a793db4dd10761e3d95

  • SHA256

    0ccdaa4b3990bcf4745acfd0ef34da97e2a8734aaa88d6b9b6bbf6b7750630e1

  • SHA512

    435c59ce6d85bba3c23820dbc85b5e91059b8f712c8c411889193f5d4a41a56e1685a23bd192fababd0e49f4f075dce5083b26a0e4b0dd917a26c5e6f9265809

  • SSDEEP

    24576:4Zts6DyaTwqfK5ASnIwHnNwVza8gswrbVWNO0Q5055Nv/aSIjfhZ:4ZtsZqf8nIynYOYNO0BlvyNfhZ

Malware Config

Extracted

Family

redline

Botnet

petin

C2

77.91.124.82:19071

Attributes
  • auth_value

    f6cf7a48c0291d1ef5a3440429827d6d

Targets

    • Target

      0ccdaa4b3990bcf4745acfd0ef34da97e2a8734aaa88d6b9b6bbf6b7750630e1

    • Size

      1.2MB

    • MD5

      52b8c6aca612750f0732e58b42e9db9e

    • SHA1

      2acc3ab9792418c585a67a793db4dd10761e3d95

    • SHA256

      0ccdaa4b3990bcf4745acfd0ef34da97e2a8734aaa88d6b9b6bbf6b7750630e1

    • SHA512

      435c59ce6d85bba3c23820dbc85b5e91059b8f712c8c411889193f5d4a41a56e1685a23bd192fababd0e49f4f075dce5083b26a0e4b0dd917a26c5e6f9265809

    • SSDEEP

      24576:4Zts6DyaTwqfK5ASnIwHnNwVza8gswrbVWNO0Q5055Nv/aSIjfhZ:4ZtsZqf8nIynYOYNO0BlvyNfhZ

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks