Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30

  • Size

    1.2MB

  • Sample

    231013-fmqqpaeh3s

  • MD5

    d73611ca509e3df6f539fa1402951811

  • SHA1

    b1d3094add29bc7325a7f7eeed0d723bf2e7ae36

  • SHA256

    e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30

  • SHA512

    7040168b6936202dbd81fa807a666120cbed09144c8e20be3950750dde505c71a33b790c48ab24be965af8299451c3c4fac4f4ead36cab53d6710ec452ff2126

  • SSDEEP

    24576:T74crraN9vX/M4w0C6syOXn6n1kAl+z9DZ6FhRnaS6zG:34crrcvX06OX6nei+DZSRnapG

Malware Config

Extracted

Family

redline

Botnet

petin

C2

77.91.124.82:19071

Attributes
  • auth_value

    f6cf7a48c0291d1ef5a3440429827d6d

Targets

    • Target

      e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30

    • Size

      1.2MB

    • MD5

      d73611ca509e3df6f539fa1402951811

    • SHA1

      b1d3094add29bc7325a7f7eeed0d723bf2e7ae36

    • SHA256

      e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30

    • SHA512

      7040168b6936202dbd81fa807a666120cbed09144c8e20be3950750dde505c71a33b790c48ab24be965af8299451c3c4fac4f4ead36cab53d6710ec452ff2126

    • SSDEEP

      24576:T74crraN9vX/M4w0C6syOXn6n1kAl+z9DZ6FhRnaS6zG:34crrcvX06OX6nei+DZSRnapG

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Executes dropped EXE

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks