Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    https://github.com//twitty1xnem/w-warthunderw/releases/download/cfhvs7k7qp/un.rar

  • Sample

    240726-ssc31awckj

Malware Config

Extracted

Family

redline

C2

185.196.9.26:6302

Targets

    • Target

      https://github.com//twitty1xnem/w-warthunderw/releases/download/cfhvs7k7qp/un.rar

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Start PowerShell.

    • Creates new service(s)

    • Downloads MZ/PE file

    • Stops running service(s)

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks