Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

16809ee081...44.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16809ee081a61a732b8784c82c0bd957d1004a372f838be574a52a240a43b044.exe

  • Size

    705KB

  • Sample

    241119-hyf2qssejq

  • MD5

    9d84c7e553e7d514ccc7411410bf2478

  • SHA1

    7a78a030f5e3842abc4a7030fe0e1976abc04e0b

  • SHA256

    16809ee081a61a732b8784c82c0bd957d1004a372f838be574a52a240a43b044

  • SHA512

    20295183be80e72dbad9a895acdf9c2f12ea61fe5e3fc3f26f6f425e45d2c4ca666e22038de8e526b897f007924487f871e69ad7716bc399c9b891bfd1b7ac30

  • SSDEEP

    12288:5y900UoxtJnZCN4cJYKigW0ZSG/NbDTq5IFeqt4rytqZKZWd:5yfUobCN4cJPWep/NneyFeqtMSCKod

Score
10/10
healerredlinediscoverydropperevasioninfostealerpersistencetrojan

Malware Config

Targets

    • Target

      16809ee081a61a732b8784c82c0bd957d1004a372f838be574a52a240a43b044.exe

    • Size

      705KB

    • MD5

      9d84c7e553e7d514ccc7411410bf2478

    • SHA1

      7a78a030f5e3842abc4a7030fe0e1976abc04e0b

    • SHA256

      16809ee081a61a732b8784c82c0bd957d1004a372f838be574a52a240a43b044

    • SHA512

      20295183be80e72dbad9a895acdf9c2f12ea61fe5e3fc3f26f6f425e45d2c4ca666e22038de8e526b897f007924487f871e69ad7716bc399c9b891bfd1b7ac30

    • SSDEEP

      12288:5y900UoxtJnZCN4cJYKigW0ZSG/NbDTq5IFeqt4rytqZKZWd:5yfUobCN4cJPWep/NneyFeqtMSCKod

    Score
    10/10
    healerredlinediscoverydropperevasioninfostealerpersistencetrojan

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Healer family

      healer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Redline family

      redline

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks