Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    dcddeb18894b2dcbd2a6c600724ee68f10243fec59aceb1888dbab55306ea605

  • Size

    470KB

  • Sample

    241108-ezheeawakr

  • MD5

    b5bcd7c12e4da4924b2f03533ca3f396

  • SHA1

    17b6a48031ae2965c3a0a168caf7ba5c610ba7b4

  • SHA256

    dcddeb18894b2dcbd2a6c600724ee68f10243fec59aceb1888dbab55306ea605

  • SHA512

    1e09c39a62745a6fb7336bde0cde1fbe12aaa80cf0f829f57945d93e9c1b573ccb0aebab6a4b5e4cbb730f2b4230ae3c5d01c14ec6246bef4b53f08a54d0175a

  • SSDEEP

    12288:JMrsy90SVOV0kp4fShOj+EOBjHyNbSlWul+VwjUoj:NyRVc7cj+EQHl5+VOUoj

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Targets

    • Target

      dcddeb18894b2dcbd2a6c600724ee68f10243fec59aceb1888dbab55306ea605

    • Size

      470KB

    • MD5

      b5bcd7c12e4da4924b2f03533ca3f396

    • SHA1

      17b6a48031ae2965c3a0a168caf7ba5c610ba7b4

    • SHA256

      dcddeb18894b2dcbd2a6c600724ee68f10243fec59aceb1888dbab55306ea605

    • SHA512

      1e09c39a62745a6fb7336bde0cde1fbe12aaa80cf0f829f57945d93e9c1b573ccb0aebab6a4b5e4cbb730f2b4230ae3c5d01c14ec6246bef4b53f08a54d0175a

    • SSDEEP

      12288:JMrsy90SVOV0kp4fShOj+EOBjHyNbSlWul+VwjUoj:NyRVc7cj+EQHl5+VOUoj

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks