Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
0x00070000000146ff-113.dat
-
Size
37KB
-
Sample
231211-lfxtbabagn
-
MD5
284868406d6bbc0bf89325b311c325ce
-
SHA1
eec0e1b6bd29fd60bb980186969d04392fe0a3ca
-
SHA256
fd3b5cae25f6e183b1d917bd9074662c7526ead9c307279d25cd979cd8805cb0
-
SHA512
550f5a20bd8fd4d4398b218c19a5f97a6bb07da826bff1398cfee1ad7cc80e67293716496236654fb252cfc848f77932ae80fe01053a60772f9d0270eb4bcd30
-
SSDEEP
768:d8n3N4JRqwg8UTB+8zx70f0PSuopLwlFFWO7:dmN4JRrg8ypxSKFFX
Behavioral task
behavioral1
Sample
0x00070000000146ff-113.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
0x00070000000146ff-113.exe
Resource
win10v2004-20231130-en
Malware Config
Extracted
smokeloader
2022
http://81.19.131.34/fks/index.php
Extracted
redline
LiveTraffic
77.105.132.87:6731
Extracted
redline
@oleh_ps
176.123.7.190:32927
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Extracted
djvu
http://zexeq.com/test1/get.php
-
extension
.hhuy
-
offline_id
gG3wF8nDWRqLztkHPAxMzpvNVlmLBMgQKmKiCNt1
-
payload_url
http://brusuax.com/dl/build2.exe
http://zexeq.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-5zKXJl7cwi Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0834ASdw
Targets
-
-
Target
0x00070000000146ff-113.dat
-
Size
37KB
-
MD5
284868406d6bbc0bf89325b311c325ce
-
SHA1
eec0e1b6bd29fd60bb980186969d04392fe0a3ca
-
SHA256
fd3b5cae25f6e183b1d917bd9074662c7526ead9c307279d25cd979cd8805cb0
-
SHA512
550f5a20bd8fd4d4398b218c19a5f97a6bb07da826bff1398cfee1ad7cc80e67293716496236654fb252cfc848f77932ae80fe01053a60772f9d0270eb4bcd30
-
SSDEEP
768:d8n3N4JRqwg8UTB+8zx70f0PSuopLwlFFWO7:dmN4JRrg8ypxSKFFX
-
Detected Djvu ransomware
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Stops running service(s)
-
Deletes itself
-
Executes dropped EXE
-
Modifies file permissions
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1