Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

e0325c992e...23.exe

windows7-x64

10

e0325c992e...23.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    35e89121e2e2a736b31e7525c1c9e419f93a40467a259ec2d2a46b662a3acaf1

  • Size

    602KB

  • Sample

    241104-rqhp2a1gjm

  • MD5

    60a19f4d797430dcea6a57d781a6dc79

  • SHA1

    9dbb6baf2c571cc9ac8f956417e412d904a4f5cf

  • SHA256

    35e89121e2e2a736b31e7525c1c9e419f93a40467a259ec2d2a46b662a3acaf1

  • SHA512

    4c3029630cea5e061750a978d98dc20dea6404b6ca4393a4b50b66f698947695804dbf15af125c020655bc968b32739739f58f05562a241e817d873d18abef30

  • SSDEEP

    12288:kSiatrmSqTftRB5oUjUqJQNzQIJHKQ0dYQ+5lHoselO9SD8zsF4EoTUG66A:nL8hxuUYqJQNzlJHKQ0pvO9KWsF4EH6A

Score
10/10
healerredlinedezikdiscoverydropperevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

dezik

C2

193.56.146.220:4174

Attributes
  • auth_value

    d39f21dca8edc10800b036ab83f4d75e

Targets

    • Target

      e0325c992e86658f9c895a8dd35827d102714cc4e9a0d2cf970f0401b8e89b23.exe

    • Size

      723KB

    • MD5

      0ad39afbfaf013b291669426dbd65bb8

    • SHA1

      d6ae48262a339a3fe55132911766dd97f6bdd520

    • SHA256

      e0325c992e86658f9c895a8dd35827d102714cc4e9a0d2cf970f0401b8e89b23

    • SHA512

      fd198a96ec215757a7a5014c3471654d50e577782e7f1bb53e75b14862550a3ec44146528dbd4a0e92ac0f1176eba4348307079bcf5c440a4853f06235b15ba1

    • SSDEEP

      12288:tPHlKPGwVTTl9OHeVLZWsV5PRkKwLDxY8krRdq72FVxPwt6qQ6TjD:xlKPVTl9IeVdt9RkMdd9JwTn

    Score
    10/10
    healerredlinedezikdiscoverydropperevasioninfostealerpersistencetrojan

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Healer family

      healer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks